CVE-2018-1000648

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2018-1000648

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000648.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2018-1000648

Published

2018-08-20T19:31:42Z

Modified

2026-07-08T14:58:52Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Write vulnerability in Patient file letter functions that can result in Write files with malicious content and may lead to remote code execution. This attack appear to be exploitable via User controlled parameters.

References

Affected packages

Git / github.com/librehealthio/lh-ehr

Affected ranges

Type

GIT

Repo

https://github.com/librehealthio/lh-ehr

Events

Introduced

ec86e543a6342c993bf2fcde66de5d3df8b2ba8a

Last Affected

ec86e543a6342c993bf2fcde66de5d3df8b2ba8a

Database specific

Show details

{
    "cpe": "cpe:2.3:a:librehealth:librehealth_ehr:2.0.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.0.0"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

2.*

2.0.0

Other

REL-2_0_0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000648.json"