OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.
id: CVE-2018-19276
info:
name: OpenMRS Platform < 2.24.0 - Insecure Object Deserialization
auth
...