CVE-2014-8072 Missing authorization in n/a
Authenticated users can bypass authorization checks to access administrative data via direct requests to the admin endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-8072?
CVE-2014-8072 is a medium-severity missing authorization vulnerability in n/a, published on 23 Oct 2014. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The administration module in OpenMRS 2.1 Standalone Edition allows remote authenticated users to obtain read access via a direct request to /admin.
Weakness: CWE-264
Which versions are affected by CVE-2014-8072?
It affects 1 product.
Products include Openmrs Openmrs.
How do I fix CVE-2014-8072?
No fix has been published for CVE-2014-8072 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2014-8072 being exploited?
There is no known exploitation of CVE-2014-8072 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2018-19276 Deserialization in n/a
- CVE-2021-43094 SQL injection in n/a
- CVE-2017-12796 Deserialization in n/a
- CVE-2026-40076 OpenMRS Core arbitrary file write and code execution via Zip Slip in module upload
- CVE-2026-40075 OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServlet
Sources
Also known as GHSA-fpr2-4824-6px3.