Vulnerability · Published Dec 27, 2022 · Assigned by VulDB
CVE-2021-4289OpenMRS openmrs-module-referenceapplication User App Page UserAppPageController.java post cross site scripting
Low 3.5
In plain English
A low-severity cross-site scripting in openmrs-module-referenceapplication from OpenMRS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).
Official description
A vulnerability classified as problematic was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x. Affected by this vulnerability is the function post of the file omod/src/main/java/org/openmrs/module/referenceapplication/page/controller/UserAppPageController.java of the component User App Page. The manipulation of the argument AppId leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.12.0 is able to address this issue. The name of the patch is 0410c091d46eed3c132fe0fcafe5964182659f74. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216883.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenMRS | openmrs-module-referenceapplication | 2.02.12.22.32.42.52.62.7 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
References
- https://vuldb.com/?id.216883 vdb-entry, technical-description
- https://vuldb.com/?ctiid.216883 signature, permissions-required
- https://github.com/openmrs/openmrs-module-referenceapplication/pull/89 issue-tracking
- https://issues.openmrs.org/browse/RA-1875 issue-tracking
- https://github.com/openmrs/openmrs-module-referenceapplication/commit/0410c091d46eed3c132fe0fcafe5964182659f74 patch
- https://github.com/openmrs/openmrs-module-referenceapplication/releases/tag/referenceapplication-2.12.0 patch