openclinic Vulnerabilities and Affected Products
Vulnerabilities associated with ga.
Products
Clear product- ga2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2023-40278HIGH | OpenClinic GA 5.247.01 - Information DisclosureAn issue was discovered in OpenClinic GA 5.247.01. An Information Disclosure vulnerability has been identified in the printAppointmentPdf.jsp component of OpenClinic GA. By changing the AppointmentUid parameter, an attacker can determine whether a specific appointment exists based on the error message. CWE-200Mar 19, 2024 | CVSS7.5v3.1 | EPSS3% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-40279HIGH | OpenClinic GA 5.247.01 - Path Traversal (Authenticated)An issue was discovered in OpenClinic GA 5.247.01. An attacker can perform a directory path traversal via the Page parameter in a GET request to main.do. CWE-22Mar 19, 2024 | CVSS7.5v3.1 | EPSS3.38% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |