Critical severity · published Mar 17, 2019
CVE-2018-19276
OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via…
9.8
CVSS
98.7%
EPSS
No
On KEV
Description
OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)98.7% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openmrs · Openmrs
1.12.0 before 1.12.1; 2.0.0 before 2.0.8; 2.1.0 before 2.1.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-19276
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-19276
Exploit
http://packetstormsecurity.com/files/151553/OpenMRS-Platform-Insecure-Object-Deserialization.html
Third Party Advisory
http://packetstormsecurity.com/files/155691/OpenMRS-Java-Deserialization-Remote-Code-Execution.html
Third Party Advisory
https://know.bishopfox.com/advisories/news/2019/02/openmrs-insecure-object-deserialization
Vendor Advisory
https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607
Exploit
https://www.exploit-db.com/exploits/46327/
More from Openmrs
9.8
CVE-2021-43094
An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone Edition <=2.4.0 via GET requests on arbitrary parameters…
9.8
CVE-2017-12796
The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input…
8.8
CVE-2026-40076
OpenMRS Core arbitrary file write and code execution via Zip Slip in module upload
8.0
CVE-2025-25928
A Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request
7.5
CVE-2026-40075
OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServlet