PatchTheCVElibrehealth vulnerabilities
Recent CVEs affecting librehealth products. 10 tracked.
librehealth has 10 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2022-06-09. Highest priority: CVE-2022-31496 (score 56/100).
- CVE-2022-31498 MEDIUM 6.1 DOWNGRADE LibreHealth EHR Base 2.0.0 allows interface/orders/patient_match_dialog.php key XSS.
- CVE-2022-31497 MEDIUM 6.1 DOWNGRADE LibreHealth EHR Base 2.0.0 allows interface/main/finder/finder_navigation.php patient XSS.
- CVE-2022-31496 HIGH 8.8 DOWNGRADE LibreHealth EHR Base 2.0.0 allows incorrect interface/super/manage_site_files.php access.
- CVE-2022-31495 MEDIUM 6.1 DOWNGRADE LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php return_page XSS.
- CVE-2022-31494 MEDIUM 6.1 DOWNGRADE LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php action XSS.
- CVE-2022-31493 MEDIUM 6.1 DOWNGRADE LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php acl_id XSS.
- CVE-2022-31492 MEDIUM 6.1 DOWNGRADE Cross Site scripting (XSS) vulnerability inLibreHealth EHR Base 2.0.0 via interface/usergroup/usergroup_admin_
- CVE-2022-29940 MEDIUM 5.4 DOWNGRADE In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\orders\fi
- CVE-2022-29939 MEDIUM 5.4 DOWNGRADE In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\billing\sl_e
- CVE-2022-29938 HIGH 8.8 DOWNGRADE In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameter payment_id in interface\billing\new_paymen
FAQ
How do I fix librehealth vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is librehealth being exploited right now?
None of the tracked librehealth CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which librehealth CVE should I patch first?
CVE-2022-31496 currently ranks highest (56/100): LibreHealth EHR Base 2.0.0 allows incorrect interface/super/manage_site_files.php access..