← Vulnerability feed

Vulnerability record · CVE-2022-23612 · published 22 February 2022

CVE-2022-23612: Openmrs path traversal vulnerability

Openmrs · Openmrs

OpenMRS is a patient-based medical record system focusing on giving providers a free customizable electronic medical record system. Affected versions are subject to arbitrary file exfiltration due to failure to sanitize request when satisfying GET requests for `/images` & `/initfilter/scripts`. This can allow an attacker to access any file on a system running OpenMRS that is accessible to the user id OpenMRS is running under. Affected implementations should update to the latest patch version of OpenMRS Core for the minor version they use. These are: 2.1.5, 2.2.1, 2.3.5, 2.4.5 and 2.5.3. As a general rule, this vulnerability is already mitigated by Tomcat's URL normalization in Tomcat 7.0.28+. Users on older versions of Tomcat should consider upgrading their Tomcat instance as well as their OpenMRS instance.

7.5 CVSS 3.1 High EPSS 1.9% · top 20.8% CWE-22 · Path traversal
7.5CVSS 3.1 base score, v2 5.0
1.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

OpenMRS is a patient-based medical record system focusing on giving providers a free customizable electronic medical record system. Affected versions are subject to arbitrary file exfiltration due to failure to sanitize request when satisfying GET requests for `/images` & `/initfilter/scripts`. This can allow an attacker to access any file on a system running OpenMRS that is accessible to the user id OpenMRS is running under. Affected implementations should update to the latest patch version of OpenMRS Core for the minor version they use. These are: 2.1.5, 2.2.1, 2.3.5, 2.4.5 and 2.5.3. As a general rule, this vulnerability is already mitigated by Tomcat's URL normalization in Tomcat 7.0.28+. Users on older versions of Tomcat should consider upgrading their Tomcat instance as well as their OpenMRS instance.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/openmrs/openmrs-core/blob/ee3373a7a775bfdfa263e2e912c72e64342fb4f0/web/src/main/java/org/openmrs/web/ PatchThird Party Advisory
https://github.com/openmrs/openmrs-core/commit/db8454bf19a092a78d53ee4dba2af628b730a6e7#diff-7c64d9f61d4d4e2ddba92920d7c PatchThird Party Advisory
https://github.com/openmrs/openmrs-core/security/advisories/GHSA-8rgr-ww69-jv65 ExploitPatchThird Party Advisory
https://lgtm.com/projects/g/openmrs/openmrs-core/snapshot/fb1335c925ca4c94be5a546707b90d2c1efa4dcc/files/web/src/main/ja PatchThird Party Advisory
https://github.com/openmrs/openmrs-core/blob/ee3373a7a775bfdfa263e2e912c72e64342fb4f0/web/src/main/java/org/openmrs/web/ PatchThird Party Advisory
https://github.com/openmrs/openmrs-core/commit/db8454bf19a092a78d53ee4dba2af628b730a6e7#diff-7c64d9f61d4d4e2ddba92920d7c PatchThird Party Advisory
https://github.com/openmrs/openmrs-core/security/advisories/GHSA-8rgr-ww69-jv65 ExploitPatchThird Party Advisory
https://lgtm.com/projects/g/openmrs/openmrs-core/snapshot/fb1335c925ca4c94be5a546707b90d2c1efa4dcc/files/web/src/main/ja PatchThird Party Advisory

Track CVE-2022-23612 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-43094Openmrs sql injection vulnerabilityAn SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone Edition <=2.4.0 via GET requ…EPSS 1.3%9.8CVE-2018-19276OpenMRS insecure XML deserialization allows unauthenticated RCEOpenMRS before 2.24.0 deserializes untrusted XML data from request bodies without adequate validation, exposing an insecure object deserialization fl…EPSS 99%analysed9.8CVE-2017-12796Openmrs deserialization of untrusted data vulnerabilityThe Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate user…EPSS 4.2%9.4CVE-2026-40076Openmrs path traversal vulnerabilityOpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the module …EPSS 0.90%8.2CVE-2026-40075Openmrs path traversal vulnerabilityOpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the `/openm…EPSS 0.72%8.0CVE-2025-25928Openmrs cross-site request forgery vulnerabilityA Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary opera…EPSS 0.28%6.8CVE-2025-25927Openmrs cross-site request forgery vulnerabilityA Cross-Site Request Forgery (CSRF) in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request.EPSS 0.26%6.8CVE-2014-8073Openmrs cross-site request forgery vulnerabilityCross-site request forgery (CSRF) vulnerability in OpenMRS 2.1 Standalone Edition allows remote attackers to hijack the authentication of administrat…EPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2022-23612), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.