CVE-2020-13569

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-13569
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-13569.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-13569
Published
2021-01-28T13:15:11.907Z
Modified
2026-07-08T20:30:21.671801Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A cross-site request forgery vulnerability exists in the GACL functionality of OpenEMR 5.0.2 and development version 6.0.0 (commit babec93f600ff1394f91ccd512bcad85832eb6ce). A specially crafted HTTP request can lead to the execution of arbitrary requests in the context of the victim. An attacker can send an HTTP request to trigger this vulnerability.

References

Affected packages

Git / github.com/openemr/openemr

Affected ranges

Type
GIT
Repo
https://github.com/openemr/openemr
Events
Introduced
35a67d11567419866d8aa9de0ae355676eeebede
Last affected
35a67d11567419866d8aa9de0ae355676eeebede
Database specific 
{
    "cpe": "cpe:2.3:a:open-emr:openemr:5.0.2:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "5.0.2"
        },
        {
            "last_affected": "5.0.2"
        }
    ]
}

Affected versions

5.*
5.0.2
Other
v5_0_2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-13569.json"