CVE-2017-16540

Published: Nov 4, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter.

Affected (1)

Products: Open Emr: Openemr

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Open Emr Openemr	Before 5.0.0

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (6)

http://www.open-emr.org/wiki/index.php/OpenEMR_Patches

Source: cve@mitre.org

Issue TrackingPatchVendor Advisory

http://www.securityfocus.com/bid/101983

Source: cve@mitre.org

https://isears.github.io/jekyll/update/2017/10/28/openemr-database-disclosure.html

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

http://www.open-emr.org/wiki/index.php/OpenEMR_Patches

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchVendor Advisory

http://www.securityfocus.com/bid/101983

Source: af854a3a-2127-422b-91ae-364da2661108

https://isears.github.io/jekyll/update/2017/10/28/openemr-database-disclosure.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingThird Party Advisory

Timeline

No history available yet.