CVE-2023-40275

Published: Mar 19, 2024Modified: Apr 14, 2025

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Exploitability: 3.9 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue was discovered in OpenClinic GA 5.247.01. It allows retrieval of patient lists via queries such as findFirstname= to _common/search/searchByAjax/patientslistShow.jsp.

Affected (1)

Products: Openclinic Ga Project: Openclinic Ga

Openclinic Ga Project

1 product

Openclinic Ga

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openclinic Ga Project Openclinic Ga	Version 5.247.01

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

https://github.com/BugBountyHunterCVE/CVE-2023-40275/blob/main/CVE-2023-40275_Unauthenticated-Patient-List-Retrieval_OpenClinic-GA_5.247.01_Report.md

Source: cve@mitre.org

Broken Link

https://sourceforge.net/projects/open-clinic/

Source: cve@mitre.org

Product

https://github.com/BugBountyHunterCVE/CVE-2023-40275/blob/main/CVE-2023-40275_Unauthenticated-Patient-List-Retrieval_OpenClinic-GA_5.247.01_Report.md

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

https://sourceforge.net/projects/open-clinic/

Source: af854a3a-2127-422b-91ae-364da2661108

Product

Timeline

No history available yet.