XML External Entity Vulnerability in HTML Form Entry by OpenMRS
CVE-2018-16521

9.8CRITICAL

Key Information:

Vendor

Openmrs

Status
Html Form Entry
Vendor
CVE Published:
5 September 2018

What is CVE-2018-16521?

An XML External Entity (XXE) vulnerability was identified in HTML Form Entry version 3.7.0, which is included in OpenMRS Reference Application 2.8.0. This vulnerability could allow an attacker to exploit XML input to gain access to sensitive data, manipulate the system, or perform other malicious actions. It highlights the importance of validating and sanitizing XML input to prevent possible exploitation.

References

https://github.com/openmrs/openmrs-module-htmlformentry/p...
x_refsource_MISC
https://github.com/openmrs/openmrs-module-htmlformentry/p...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.