CVE-2023-40278

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-40278
An issue was discovered in OpenClinic GA 5.247.01. An Information Disclosure vulnerability has been identified in the printAppointmentPdf.jsp component of OpenClinic GA. By changing the AppointmentUid parameter, an attacker can determine whether a specific appointment exists based on the error message.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/BugBountyHunterCVE/CVE-2023-40278/blob/main/CVE-2023-40278_Information-Disclosure_OpenClinic-GA_5.247.01_Report.md Exploit Third Party Advisory
https://sourceforge.net/projects/open-clinic/ Product
https://github.com/BugBountyHunterCVE/CVE-2023-40278/blob/main/CVE-2023-40278_Information-Disclosure_OpenClinic-GA_5.247.01_Report.md Exploit Third Party Advisory
https://sourceforge.net/projects/open-clinic/ Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:openclinic_ga_project:openclinic_ga:5.247.01:*:*:*:*:*:*:*
History

14 Apr 2025, 13:40

Type Values Removed Values Added
References () https://github.com/BugBountyHunterCVE/CVE-2023-40278/blob/main/CVE-2023-40278_Information-Disclosure_OpenClinic-GA_5.247.01_Report.md - () https://github.com/BugBountyHunterCVE/CVE-2023-40278/blob/main/CVE-2023-40278_Information-Disclosure_OpenClinic-GA_5.247.01_Report.md - Exploit, Third Party Advisory
References () https://sourceforge.net/projects/open-clinic/ - () https://sourceforge.net/projects/open-clinic/ - Product
First Time Openclinic Ga Project openclinic Ga
Openclinic Ga Project
CPE cpe:2.3:a:openclinic_ga_project:openclinic_ga:5.247.01:*:*:*:*:*:*:*

21 Nov 2024, 08:19

Type Values Removed Values Added
References () https://github.com/BugBountyHunterCVE/CVE-2023-40278/blob/main/CVE-2023-40278_Information-Disclosure_OpenClinic-GA_5.247.01_Report.md - () https://github.com/BugBountyHunterCVE/CVE-2023-40278/blob/main/CVE-2023-40278_Information-Disclosure_OpenClinic-GA_5.247.01_Report.md -
References () https://sourceforge.net/projects/open-clinic/ - () https://sourceforge.net/projects/open-clinic/ -

01 Aug 2024, 13:44

Type Values Removed Values Added
Summary
  • (es) Se descubrió un problema en OpenClinic GA 5.247.01. Se ha identificado una vulnerabilidad de divulgación de información en el componente printAppointmentPdf.jsp de OpenClinic GA. Al cambiar el parámetro AppointmentUid, un atacante puede determinar si existe una cita específica en función del mensaje de error.
CWE CWE-200
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

19 Mar 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-19 12:15

Updated : 2025-04-14 13:40

NVD link : CVE-2023-40278

Mitre link : CVE-2023-40278

CVE.ORG link : CVE-2023-40278

JSON object : View

Products Affected

openclinic_ga_project

  • openclinic_ga
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor