Threats tagged 'ghsa-3wqv-qpc6-2469'

A path traversal vulnerability exists in OpenClinica Community Edition versions up to 3.12.2 and 3.13 in the CRF Data Import component. The issue arises from manipulation of the xml_file argument in the /ImportCRFData?action=confirm endpoint, allowing remote attackers to traverse directories. Public exploit code is available, but the vendor has not responded or provided a fix.