CVE-2020-14491

MEDIUM

OpenClinic GA 5.09.02 and 5.89.05b - Missing Authorization in SQL Query Execution

Title source: llm
STIX 2.1

Description

OpenClinic GA versions 5.09.02 and 5.89.05b do not properly check permissions before executing SQL queries, which may allow a low-privilege user to access privileged information.

References (1)

Core 1
Core References
Third Party Advisory, US Government Resource x_refsource_misc
https://us-cert.cisa.gov/ics/advisories/icsma-20-184-01

Scores

CVSS v3 6.5
EPSS 0.0084
EPSS Percentile 53.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-862
Status published
Products (2)
openclinic_ga_project/openclinic_ga 5.09.02
openclinic_ga_project/openclinic_ga 5.89.05b
Published Jul 20, 2020
Tracked Since Feb 18, 2026