CVE-2018-16795

OpenEMR 5.0.1.3 allows Cross-Site Request Forgery (CSRF) via library/ajax and interface/super, as demonstrated by use of interface/super/manage_site_files.php to upload a .php file.

Score

CVSS 3.1 8.8 High

Status

Modified - cve@mitre.org

Published

2020-12-31

Last modified

2024-08-05

Weaknesses

CWE-352

Affected products

• Openemr (Open-emr)

References

• https://community.open-emr.org/t/openemr-security/10597
• https://www.open-emr.org/wiki/images/1/11/Openemr_insecurity.pdf