# Question about Web Services CVE on Older versions of OpenMRS

**URL:** <https://talk.openmrs.org/t/question-about-web-services-cve-on-older-versions-of-openmrs/21677>\
**Category:** Development\
**Created:** [February 7, 2019, 8:59pm UTC](https://talk.openmrs.org/t/question-about-web-services-cve-on-older-versions-of-openmrs/21677 "2019-02-07T20:59:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![craigappl](https://talk.openmrs.org/letter_avatar/craigappl/32/6_22734026db12803ebb3e059622ac3534.png) [@craigappl](https://talk.openmrs.org/u/craigappl)\
**Post date:** [February 7, 2019, 8:59pm UTC](https://talk.openmrs.org/t/question-about-web-services-cve-on-older-versions-of-openmrs/21677/1 "2019-02-07T20:59:05Z")

</div>

Hi,

I received the CVE on the Web Services module: [Critical Security Advisory CVE-2018-19276: 2019-02-04](https://talk.openmrs.org/t/critical-security-advisory-cve-2018-19276-2019-02-04/21607/1) We have a few older versions of OpenMRS that are on 1.12.x and they may not be able to upgrade to the latest version of the web services module. Can you point us to the specific commits that fix this vulnerability?

Thanks, Craig

FYI @burke, @isears

---

<div class="post-metadata">

**Author:** ![dkayiwa](https://talk.openmrs.org/user_avatar/talk.openmrs.org/dkayiwa/32/179_2.png) [@dkayiwa](https://talk.openmrs.org/u/dkayiwa)\
**Post date:** [February 7, 2019, 9:16pm UTC](https://talk.openmrs.org/t/question-about-web-services-cve-on-older-versions-of-openmrs/21677/2 "2019-02-07T21:16:50Z")

</div>

This module supports all the way up to platform 1.9.x [https://addons.openmrs.org/show/org.openmrs.module.webservices-rest](https://addons.openmrs.org/show/org.openmrs.module.webservices-rest)

---

<div class="post-metadata">

**Author:** ![isears](https://talk.openmrs.org/user_avatar/talk.openmrs.org/isears/32/8566_2.png) [@isears](https://talk.openmrs.org/u/isears)\
**Post date:** [February 7, 2019, 10:24pm UTC](https://talk.openmrs.org/t/question-about-web-services-cve-on-older-versions-of-openmrs/21677/3 "2019-02-07T22:24:20Z")

</div>

Hi Craig!

The fix was done in two PRs:

> <https://github.com/openmrs/openmrs-module-webservices.rest/pull/369>

> <https://github.com/openmrs/openmrs-module-webservices.rest/pull/372>

It wasn’t an especially complex fix. If you (or anyone else for that matter) have any issues with this on 1.12.x feel free to ping me about it!