OpenEMR 代码问题漏洞
CVE编号
CVE-2022-4506利用情况
暂无补丁情况
N/A披露时间
2022-12-15漏洞描述
OpenEMR是OpenEMR社区的一套开源的医疗管理系统。该系统可用于医疗实践管理、电子医疗记录、处方书写和医疗帐单申请。OpenEMR 7.0.0.2之前版本存在代码问题漏洞，该漏洞源于没有限制上传危险类型的文件。解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接 |
|
|---|---|
| https://github.com/openemr/openemr/commit/2e7678d812df167ea3c0756382408b670e8aa51f | |
| https://huntr.dev/bounties/f423d193-4ab0-4f03-ad90-25e4f02e7942 | |
| https://www.cve.org/CVERecord?id=CVE-2022-4506 |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | open-emr | openemr | * | Up to (excluding) 7.0.0.2 | |||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_2 | python | * | Up to (excluding) 2.7.18-1.amzn2.0.6 | |||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_AMI | python38 | * | Up to (excluding) 2.7.18-2.145.amzn1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | anolis_os_8 | python3-idle | * | Up to (excluding) 1.7.1-4 | |||||
| 运行在以下环境 | |||||||||
| 系统 | centos_8 | platform-python-devel | * | Up to (excluding) 3.6.8-48.el8_7.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_35 | varnish-devel | * | Up to (excluding) 4.16.5-1.fc35 | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_35_Modular | varnish | * | Up to (excluding) 6.0-3520221118143100.f27b74a8 | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_36 | varnish-docs | * | Up to (excluding) 3.10.8-2.fc36 | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_36_Modular | varnish | * | Up to (excluding) 6.0-3620221118143100.5e5ad4a0 | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_37 | varnish-docs | * | Up to (excluding) 7.3.12-3.fc37 | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_37_Modular | varnish | * | Up to (excluding) 6.0-3720221118143100.9e842022 | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_38 | python2.7-debugsource | * | Up to (excluding) 7.3.12-3.fc38 | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_39 | pypy-libs-debuginfo | * | Up to (excluding) 7.3.12-3.fc39 | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_40 | pypy-libs-debuginfo | * | Up to (excluding) 7.3.12-3.fc40 | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_EPEL_8 | xfce4-settings-debuginfo | * | Up to (excluding) 4.16.5-2.el8 | |||||
| 运行在以下环境 | |||||||||
| 系统 | kylinos_aarch64_V10SP1 | python3 | * | Up to (excluding) 3.7.9-20.p04.se.ky10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | kylinos_aarch64_V10SP2 | python3 | * | Up to (excluding) 3.7.9-20.p04.se.ky10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | kylinos_x86_64_V10SP1 | python3 | * | Up to (excluding) 3.7.9-20.p04.se.ky10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | kylinos_x86_64_V10SP2 | python3 | * | Up to (excluding) 3.7.9-20.p04.se.ky10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.3 | python39-dbm | * | Up to (excluding) 3.9.15-150300.4.21.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.4 | libvarnishapi3 | * | Up to (excluding) 3.10.10-150400.4.22.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_8 | platform-python-devel | * | Up to (excluding) 3.6.8-48.el8_7.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP5 | python3 | * | Up to (excluding) 3.4.10-25.102.2 | |||||
- 攻击路径 网络
- 攻击复杂度 低
- 权限要求 低
- 影响范围 未更改
- 用户交互 无
- 可用性 高
- 保密性 高
- 完整性 高
| CWE-ID | 漏洞类型 |
| CWE-434 | 危险类型文件的不加限制上传 |
Exp相关链接
版权声明
本站原创文章转载请注明文章出处及链接，谢谢合作！
评论