CVE-2020-36243: OS Command Injection
Published Feb 7, 2021
·Updated
The Patient Portal of OpenEMR 5.0.2.1 is affected by a Command Injection vulnerability in /interface/main/backup.php. To exploit the vulnerability, an authenticated attacker can send a POST request that executes arbitrary OS commands via shell metacharacters.
Affected Software
1 affected component
open-emr Openemr=5.0.2.1
Remediation
Patch Available
Event History
Feb 7, 2021
CVE Published
via MITRE·07:59 PM
Data Sourced
via MITRE·07:59 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-36243?
CVE-2020-36243 has a medium severity level due to the potential for command injection by an authenticated attacker.
2
How do I fix CVE-2020-36243?
To fix CVE-2020-36243, upgrade OpenEMR to version 5.0.2.2 or later where the vulnerability is patched.
3
Who is affected by CVE-2020-36243?
CVE-2020-36243 affects users of OpenEMR version 5.0.2.1.
4
What kind of vulnerability is CVE-2020-36243?
CVE-2020-36243 is a command injection vulnerability that allows execution of arbitrary OS commands.
5
What components of OpenEMR are involved in CVE-2020-36243?
CVE-2020-36243 specifically involves the 'backup.php' file in the OpenEMR Patient Portal.