{"id":"CVE-2018-19276","aliases":["EUVD-2018-10982","GHSA-785q-xwp9-2xw7"],"status":"published","title":"OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows...","description":"OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.","severity":{"version":"3.0","score":10,"vector":"CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.98744,"percentile":0.99925,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-502"],"published":"2019-03-17T21:30:20Z","modified":"2026-10-24T10:31:05Z","exploits":[{"source":"exploitdb","id":"EDB-46327","title":"OpenMRS Platform \u003c 2.24.0 - Insecure Object Deserialization","type":"webapps","platform":"java","date":"2019-02-05","url":"https://www.exploit-db.com/exploits/46327"},{"source":"exploitdb","id":"EDB-47792","title":"OpenMRS - Java Deserialization RCE (Metasploit)","type":"remote","platform":"linux","date":"2019-12-18","verified":true,"url":"https://www.exploit-db.com/exploits/47792"},{"source":"metasploit","id":"exploit/multi/http/openmrs_deserialization","title":"OpenMRS Java Deserialization RCE","type":"exploit","platform":"Linux,Unix","date":"2019-02-04","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/openmrs_deserialization"},{"source":"nuclei","id":"CVE-2018-19276","title":"OpenMRS Platform \u003c 2.24.0 - Insecure Object Deserialization","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-19276.yaml"},{"source":"pocgithub","id":"mpgn/CVE-2018-19276","title":"mpgn/CVE-2018-19276","date":"2019-03-11","url":"https://github.com/mpgn/CVE-2018-19276"}],"products":[{"vendor":"openmrs","product":"openmrs"}],"references":[{"url":"http://packetstormsecurity.com/files/151553/OpenMRS-Platform-Insecure-Object-Deserialization.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://www.exploit-db.com/exploits/46327/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://packetstormsecurity.com/files/155691/OpenMRS-Java-Deserialization-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://know.bishopfox.com/advisories/news/2019/02/openmrs-insecure-object-deserialization","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19276"},{"url":"https://github.com/advisories/GHSA-785q-xwp9-2xw7"}],"sources":{"cve":[{"id":"CVE-2018-19276","description":"OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.","status":"published","published":"2019-03-17T21:30:20Z","modified":"2024-08-05T11:30:04.048Z","cvss":[{"version":"3.0","score":10,"vector":"CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N","level":"critical","assessor":"cna"}],"updated_at":"2026-11-02T14:35:02.966615Z"}],"euvd":[{"id":"EUVD-2018-10982","description":"OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.","status":"published","published":"2019-03-17T21:30:20Z","modified":"2024-08-05T11:30:04Z","cvss":[{"version":"3.0","score":10,"vector":"CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N","level":"critical"}],"updated_at":"2026-11-03T02:39:33.782065Z"}],"ghsa":[{"id":"GHSA-785q-xwp9-2xw7","title":"OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows...","description":"OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.","status":"published","published":"2022-05-13T01:33:35Z","modified":"2023-02-01T05:08:14Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:50:42.874485Z"}],"nvd":[{"id":"CVE-2018-19276","description":"OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.","status":"published","published":"2019-03-21T16:00:30.39Z","modified":"2026-06-17T01:49:03.607Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.0","score":10,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:04:54.21788Z"}],"osv":[{"id":"CVE-2018-19276","description":"OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.","status":"published","published":"2019-03-21T16:00:30.39Z","modified":"2026-10-24T10:31:05.318472537Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:08.834469Z"}]}}