CVE-2020-19364: Malicious File Upload
Published Jan 20, 2021
·Updated
OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php.
Affected Software
1 affected component
open-emr Openemr=5.0.1
Event History
Jan 20, 2021
CVE Published
via MITRE·12:44 AM
Data Sourced
via MITRE·12:44 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-19364?
CVE-2020-19364 has a high severity rating, as it allows authenticated attackers to execute malicious PHP scripts.
2
How do I fix CVE-2020-19364?
To fix CVE-2020-19364, upgrade OpenEMR to a version later than 5.0.1 that addresses this vulnerability.
3
What systems are affected by CVE-2020-19364?
CVE-2020-19364 affects OpenEMR version 5.0.1, allowing script execution via a specific vulnerable endpoint.
4
Who can exploit CVE-2020-19364?
Authenticated users with access to the OpenEMR system can exploit CVE-2020-19364 to upload malicious scripts.
5
What potential impact does CVE-2020-19364 have?
Exploitation of CVE-2020-19364 can lead to unauthorized remote code execution on the affected OpenEMR instance.