CVE-2020-14490

Summary

OpenClinic GA 5.09.02 and 5.89.05b includes arbitrary local files specified within its parameter and executes some files, which may allow disclosure of sensitive files or the execution of malicious uploaded files.

Affected Software

VendorProductVersion RangeStatus
open sourceOpenClinic GA5.09.02affected
open sourceOpenClinic GA5.89.05baffected

Weaknesses

  • CWE-22: IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22

Workarounds

OpenClinic GA is aware of these vulnerabilities but has not provided any confirmation of their resolution. Please upgrade to the latest version to ensure you have all current fixes.

ADP Enrichment

CVE Program Container

Additional References

References