CVE-2018-19276 Deserialization in n/a
Unauthenticated attackers can execute arbitrary commands on OpenMRS systems by sending crafted XML data due to insecure object deserialization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-19276?
CVE-2018-19276 is a critical unsafe deserialization vulnerability in n/a, published on 17 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.
Weakness: CWE-502
Which versions are affected by CVE-2018-19276?
It affects 1 product.
Products include Openmrs Openmrs.
How do I fix CVE-2018-19276?
No fix has been published for CVE-2018-19276 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2018-19276 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-19276 exists.
Public exploit code: 1 Metasploit module, 2 Exploit-DB entries, 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2021-43094 SQL injection in n/a
- CVE-2017-12796 Deserialization in n/a
- CVE-2026-40076 OpenMRS Core arbitrary file write and code execution via Zip Slip in module upload
- CVE-2026-40075 OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServlet
- CVE-2025-25928 Cross-site request forgery in n/a
Sources
Also known as GHSA-785q-xwp9-2xw7.