Critical severity9.8OSV Advisory· Published Mar 21, 2019· Updated Jun 17, 2026

CVE-2018-19276

Description

OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Openmrs/Openmrs CoreOSV
Range: 1.12.0, 2.0.0, 2.0.1, …
Openmrs/Openmrs2 versions
cpe:2.3:a:openmrs:openmrs:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:openmrs:openmrs:*:*:*:*:*:*:*:*range: >=1.12.0,<1.12.1
- (no CPE)range: <2.24.0

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/151553/OpenMRS-Platform-Insecure-Object-Deserialization.htmlnvdExploitThird Party AdvisoryVDB Entry
www.exploit-db.com/exploits/46327/nvdExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/155691/OpenMRS-Java-Deserialization-Remote-Code-Execution.htmlnvdThird Party AdvisoryVDB Entry
know.bishopfox.com/advisories/news/2019/02/openmrs-insecure-object-deserializationnvdThird Party Advisory
talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.079
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000