{"id":"CVE-2017-12796","url":"https://www.cyber-defence.io/tools/cve/CVE-2017-12796","generatedAt":"2026-10-28T22:11:18.466Z","title":"The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects.","description":"The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system commands by crafting malicious XML payloads, as demonstrated by a single admin/reports/reportSchemaXml.form request.","published":"2017-10-23T04:29:00.000Z","lastModified":"2026-06-17T01:03:57.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-502"],"affected":["openmrs/openmrs"],"epss":{"score":0.04244,"percentile":0.90987,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (4.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://isears.github.io/jekyll/update/2017/10/21/openmrs-rce.html","tags":["Exploit"],"source":"cve@mitre.org"},{"url":"https://talk.openmrs.org/t/critical-security-advisory-2017-09-12/13291","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://wiki.openmrs.org/display/RES/Release+Notes+2.6.1","tags":["Release Notes","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://isears.github.io/jekyll/update/2017/10/21/openmrs-rce.html","tags":["Exploit"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://talk.openmrs.org/t/critical-security-advisory-2017-09-12/13291","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://wiki.openmrs.org/display/RES/Release+Notes+2.6.1","tags":["Release Notes","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-12796","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}