CVE-2023-40278

7.5 highEPSS 3.0%

High (7.5) in openclinic ga project openclinic ga. EPSS 3.0% chance of exploitation in the next 30 days.

An issue was discovered in OpenClinic GA 5.247.01. An Information Disclosure vulnerability has been identified in the printAppointmentPdf.jsp component of OpenClinic GA. By changing the AppointmentUid parameter, an attacker can determine whether a specific appointment exists based on the error message.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2024-03-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

openclinic_ga_project:openclinic_ga

References

https://github.com/BugBountyHunterCVE/CVE-2023-40278/blob/main/CVE-2023-40278_Information-Disclosure_OpenClinic-GA_5.247.01_Report.md
https://sourceforge.net/projects/open-clinic/
https://github.com/BugBountyHunterCVE/CVE-2023-40278/blob/main/CVE-2023-40278_Information-Disclosure_OpenClinic-GA_5.247.01_Report.md
https://sourceforge.net/projects/open-clinic/

Check your stack JSON