1. Home
  2. CVE Database
  3. CVE-2018-1000645
MEDIUM · 6.5

CVE-2018-1000645

LibreHealthIO lh-ehr version <REL-2.0.0 contains an Authenticated Local File Disclosure vulnerability in Importing of templates allows local file disclosure that can result in Disclosure of sensitive ...

Vulnerability Description

LibreHealthIO lh-ehr version <REL-2.0.0 contains an Authenticated Local File Disclosure vulnerability in Importing of templates allows local file disclosure that can result in Disclosure of sensitive files on the server. This attack appear to be exploitable via User controlled variable in import templates function.

CVSS Score

6.5

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
LibrehealthLibrehealth Ehr< 2.0.0

Related Weaknesses (CWE)

CWE-200

References

FAQ

What is CVE-2018-1000645?

CVE-2018-1000645 is a vulnerability with a CVSS score of 6.5 (MEDIUM). LibreHealthIO lh-ehr version <REL-2.0.0 contains an Authenticated Local File Disclosure vulnerability in Importing of templates allows local file disclosure that can result in Disclosure of sensitive ...

How severe is CVE-2018-1000645?

CVE-2018-1000645 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-1000645?

Check the references section above for vendor advisories and patch information. Affected products include: Librehealth Librehealth Ehr.