CVE-2023-40278

Published: Mar 19, 2024Modified: Apr 14, 2025

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue was discovered in OpenClinic GA 5.247.01. An Information Disclosure vulnerability has been identified in the printAppointmentPdf.jsp component of OpenClinic GA. By changing the AppointmentUid parameter, an attacker can determine whether a specific appointment exists based on the error message.

Affected (1)

Products: Openclinic Ga Project: Openclinic Ga

Openclinic Ga Project

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openclinic Ga Project Openclinic Ga	Version 5.247.01

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

https://github.com/BugBountyHunterCVE/CVE-2023-40278/blob/main/CVE-2023-40278_Information-Disclosure_OpenClinic-GA_5.247.01_Report.md

Source: cve@mitre.org

ExploitThird Party Advisory

https://sourceforge.net/projects/open-clinic/

Source: cve@mitre.org

Product

https://github.com/BugBountyHunterCVE/CVE-2023-40278/blob/main/CVE-2023-40278_Information-Disclosure_OpenClinic-GA_5.247.01_Report.md

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://sourceforge.net/projects/open-clinic/

Source: af854a3a-2127-422b-91ae-364da2661108

Product

Timeline

No history available yet.