Vulnerability · Published Jul 29, 2020 · Assigned by icscert
CVE-2020-14487OpenClinic GA
Critical 9.4
In plain English
A critical-severity security flaw in OpenClinic GA from open source. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities).
Severity (CVSS 3.1)9.4Critical
Exploit odds (30 days)2.2%top 17.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account, which may allow an attacker to login and execute arbitrary commands.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| open source | OpenClinic GA | 5.09.02 |
Weakness: CWE-912 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
References
- https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01 x_refsource_MISC