PT-2017-18052 · Openmrs · Openmrs Reporting Module

Published 2017-04-21 · Updated 2017-04-26 · CVE-2017-7990

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenMRS Reporting Module version 1.12.0

Description The issue allows for CSRF attacks with resultant XSS, where administrative authentication can be hijacked to insert JavaScript into a name field in the "webapp/reports/manageReports.jsp" endpoint. This can lead to unauthorized access and malicious actions.

Recommendations For OpenMRS Reporting Module version 1.12.0, consider disabling access to the "webapp/reports/manageReports.jsp" endpoint until a patch is available to prevent CSRF and XSS attacks. Restrict administrative authentication to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-7990

Affected Products

Openmrs Reporting Module

References · 4

• 🔥 https://youtube.com/watch?v=pfrIaNvIuFY · Exploit
• https://github.com/openmrs/openmrs-module-reporting/pull/141/commits/0023a659288538d2763835847d3414ecb18b931a#diff-50e25eddc5909110fa3d31090877c2fd · Patch
• https://osv.dev/vulnerability/CVE-2017-7990 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7990 · Security Note