Threats tagged 'ghsa-jxxq-v434-pmg5'

OpenClinica Community Edition up to versions 3.12.2 and 3.13 contains a vulnerability in the CRF Data Import component. The issue involves XML injection via manipulation of the xml_file argument in the /ImportCRFData?action=confirm endpoint. This vulnerability can be exploited remotely and has been publicly disclosed. The vendor has not responded to the disclosure, and no patch information is available. The CVSS score is 4.3, indicating a medium severity level.