Back to overview

CVE-2020-27227

CRITICAL
10.0
CVSS 3.0
Description
An exploitable unatuhenticated command injection exists in the OpenClinic GA 5.173.3. Specially crafted web requests can cause commands to be executed on the server. An attacker can send a web request with parameters containing specific parameter to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and compromise underlying operating system.

Metadata

CVE ID
CVE-2020-27227
State
PUBLISHED
Assigner
talos
Reserved
2020-10-19 00:00 UTC
Published
2021-04-13 14:12 UTC
Last updated
2024-08-04 16:11 UTC
Primary CWE
CWE-77
CWE-77: Improper Neutralization of Special Elements used in …
Vendor / Product
n/a / OpenClinic
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products (1)
VendorProductPlatformVersions
n/a OpenClinic — OpenClinic GA 5.173.3
Weakness (CWE)
CWESourceDescription
CWE-77 cna CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.0 cna CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References (1)
Back to overview