CVE-2020-24621

Katalog CVE

CVSS 8.8 · High EPSS 3,2%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada openmrs htmlformentry. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A remote code execution (RCE) vulnerability was discovered in the htmlformentry (aka HTML Form Entry) module before 3.11.0 for OpenMRS. By leveraging path traversal, a malicious Velocity Template Language file could be written to a directory. This file could then be accessed and executed.

Rincian

Terbit di NVD

25 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

3,2% peluang dieksploitasi; lebih tinggi dari 87,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://issues.openmrs.org/browse/HTML-730 advisory vendor
• https://github.com/openmrs/openmrs-module-htmlformentry/pull/178 patch · advisory pihak ketiga
• https://github.com/openmrs/openmrs-module-uiframework/pull/59 patch · advisory pihak ketiga
• https://www.contrastsecurity.com/security-influencers advisory pihak ketiga
• https://www.contrastsecurity.com/security-influencers/authenticated-remote-code-execution-openmrs exploit · advisory pihak ketiga