CVE-2019-14530: Path Traversal
An issue was discovered in custom/ajaxdownload.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by the user www-data) from server storage. If the requested file is writable for the www-data user and the directory /var/www/openemr/sites/default/documents/cqmqrda/ exists, it will be deleted from server.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-14530?
CVE-2019-14530 has been classified with a high severity due to the potential for unauthorized file access.
How do I fix CVE-2019-14530?
To fix CVE-2019-14530, update OpenEMR to version 5.0.2 or later to eliminate the vulnerability.
What software is affected by CVE-2019-14530?
CVE-2019-14530 affects OpenEMR versions prior to 5.0.2.
What type of attack is CVE-2019-14530 associated with?
CVE-2019-14530 is associated with path traversal attacks that allow attackers to access unauthorized files on the server.
Who can exploit CVE-2019-14530?
Any user with knowledge of the fileName parameter can potentially exploit CVE-2019-14530 if they have access to the OpenEMR application.