CVE-2018-1000645 - LibreHealthIO lh-ehr version <REL-2.0.0 contains an Authenticated Local File Disclosure vulnerability in Importing of templates allows local file disclosure that can result in Disclosure of sensitive files on the server

Back Back to CVE browser

MEDIUM

LibreHealthIO lh-ehr version <REL-2.0.0 contains an Authenticated Local File Disclosure vulnerability in Importing of templates allows local file disclosure that can result in Disclosure of sensitive files on the server

Published Aug 20, 2018

6.5

MEDIUM

CVSS 3.0

EPSS 1.37%

Description

LibreHealthIO lh-ehr version <REL-2.0.0 contains an Authenticated Local File Disclosure vulnerability in Importing of templates allows local file disclosure that can result in Disclosure of sensitive files on the server. This attack appear to be exploitable via User controlled variable in import templates function.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (3)

https://0dd.zone/2018/08/05/lh-ehr-Authenticated-Local-File-Disclosure/
x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-1976
Advisory
https://github.com/LibreHealthIO/lh-ehr/issues/1210
x_refsource_CONFIRMExploitThird Party Advisory

Link	Providers	Tags
https://0dd.zone/2018/08/05/lh-ehr-Authenticated-Local-File-Disclosure/		x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-1976		Advisory
https://github.com/LibreHealthIO/lh-ehr/issues/1210		x_refsource_CONFIRMExploitThird Party Advisory