CVE-2017-12796 Deserialization in n/a
Unauthenticated attackers can execute arbitrary OS commands via malicious XML deserialization in the OpenMRS Reporting Compatibility Add On.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-12796?
CVE-2017-12796 is a critical unsafe deserialization vulnerability in n/a, published on 23 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system commands by crafting malicious XML payloads, as demonstrated by a single admin/reports/reportSchemaXml.form request.
Weakness: CWE-502
Which versions are affected by CVE-2017-12796?
It affects 1 product.
Products include Openmrs Openmrs.
How do I fix CVE-2017-12796?
No fix has been published for CVE-2017-12796 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2017-12796 being exploited?
There is no known exploitation of CVE-2017-12796 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2018-19276 Deserialization in n/a
- CVE-2021-43094 SQL injection in n/a
- CVE-2026-40076 OpenMRS Core arbitrary file write and code execution via Zip Slip in module upload
- CVE-2026-40075 OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServlet
- CVE-2025-25928 Cross-site request forgery in n/a
Sources
Also known as GHSA-q5p3-m74j-g94p.