CVE-2024-37734 - Vulnerability Details - OpenCVE

ReportizFlow

An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact total

Vendors	Products
Open-emr	Openemr
Openemr	Openemr

Configuration 1 [-]

cpe:2.3:a:open-emr:openemr:7.0.2:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/A3h1nt/CVEs/tree/main/OpenEMR
https://github.com/openemr/openemr/pull/7435#event-12872646667

History

Mon, 14 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00492}`	epss `{'score': 0.00629}`

Thu, 01 May 2025 20:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Open-emr Open-emr openemr
CPEs		cpe:2.3:a:open-emr:openemr:7.0.2:::::::*
Vendors & Products		Open-emr Open-emr openemr

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-06-26T00:00:00

Updated: 2024-08-02T03:57:39.749Z

Reserved: 2024-06-10T00:00:00

Link: CVE-2024-37734

Vulnrichment

Updated: 2024-06-27T13:36:57.393Z

NVD

Status : Analyzed

Published: 2024-06-26T22:15:10.533

Modified: 2025-05-01T19:38:20.270

Link: CVE-2024-37734

Redhat

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-37734", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-02T03:57:39.749Z", "dateReserved": "2024-06-10T00:00:00", "datePublished": "2024-06-26T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-06-26T21:27:24.441054"}, "descriptions": [{"lang": "en", "value": "An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/A3h1nt/CVEs/tree/main/OpenEMR"}, {"url": "https://github.com/openemr/openemr/pull/7435#event-12872646667"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-279", "lang": "en", "description": "CWE-279 Incorrect Execution-Assigned Permissions"}]}], "affected": [{"vendor": "openemr", "product": "openemr", "cpes": ["cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "7.0.2", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-06-27T13:29:14.390246Z", "id": "CVE-2024-37734", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-27T13:37:09.401Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:57:39.749Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/A3h1nt/CVEs/tree/main/OpenEMR", "tags": ["x_transferred"]}, {"url": "https://github.com/openemr/openemr/pull/7435#event-12872646667", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}