PT-2020-12605 · Librehealthio · Librehealth Emr

Chris Davis · Published 2020-07-15 · Updated 2020-07-17 · CVE-2020-11436

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibreHealth EMR version 2.0.0

Description The issue allows for cross-site scripting (XSS) attacks, which can force arbitrary actions on behalf of other users, including administrators. This means an attacker could potentially perform actions as if they were another user, without that user's knowledge or consent.

Recommendations For LibreHealth EMR version 2.0.0, as a temporary workaround, consider disabling any features that may be susceptible to XSS attacks until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of exploitation. Avoid using the application for critical tasks that could be compromised by an XSS attack until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-11436

Affected Products

Librehealth Emr

References · 6

• 🔥 https://labs.bishopfox.com/advisories/librehealth-version-2.0.0-0 · Exploit
• https://librehealth.io · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11436 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11436 · Vendor Advisory
• https://know.bishopfox.com/advisories · Note
• https://t.me/cvenotify/5067 · Telegram Post