Threats tagged 'ghsa-jjgj-cx3q-pw4w'

OpenMRS Core versions up to 2.7.8 have a path traversal vulnerability in the ModuleResourcesServlet, allowing unauthenticated attackers to read arbitrary files on the server. This occurs because the servlet does not properly validate user-supplied paths, enabling directory traversal outside the intended module resource directories. Exploitation requires the server to run on Apache Tomcat versions earlier than 8.5.31, as later versions mitigate the bypass at the container level. A fix is available in OpenMRS version 2.8.6.