CVE-2018-19276 in the critical feed json
OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitr…
published 2019-03-17 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-10982
- cvss
- 10.0
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 98.7%
- EPSS 98.7% chance of exploitation in 30 days, percentile 99.9%
- public exploits
- 3
- Metasploit, Exploit-DB, plus a Nuclei check
Summary
OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.
Patch / fix
- openmrs openmrs 1.12.1, 2.0.8, 2.1.4
Timeline
- First public exploit (Metasploit exploit/multi/http/openmrs_deserialization)
- Published
Exploit prediction
98.74% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/multi/http/openmrs_deserialization OpenMRS Java Deserialization RCE metasploit exploit, normal rank, 2019-02-04
- EDB-47792 OpenMRS - Java Deserialization RCE (Metasploit) remote, 2019-12-18
- EDB-46327 OpenMRS Platform < 2.24.0 - Insecure Object Deserialization webapps, 2019-02-05
- Nuclei template OpenMRS Platform < 2.24.0 - Insecure Object Deserialization nuclei detection template
- packetstormsecurity.com http://packetstormsecurity.com/files/151553/OpenMRS-Platform-Insecure-Object-Deserialization.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 10.0 | CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.0 | 10.0 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
exploit-db.com
/exploits/46327/
exploit, third-party-advisory, vdb-entry
-
packetstormsecurity.com
/files/151553/OpenMRS-Platform-Insecure-Object-Deserialization.html
exploit, third-party-advisory, vdb-entry
-
talk.openmrs.org
/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607
vendor-advisory
-
packetstormsecurity.com
/files/155691/OpenMRS-Java-Deserialization-Remote-Code-Execution.html
third-party-advisory, vdb-entry
-
know.bishopfox.com
/advisories/news/2019/02/openmrs-insecure-object-deserialization
third-party-advisory
Sources
- CVE List CVE-2018-19276
- NVD CVE-2018-19276
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.