PT-2020-18651 · Openmrs · Openmrs

Published 2020-04-17 · Updated 2021-07-21 · CVE-2020-5728

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenMRS versions 2.9 and prior

Description The issue concerns insufficient validation of the referrer header value, which is copied into an HTML element named redirectUrl within various webpages, such as login.htm. This insufficient validation allows for the possibility of cross-site scripting.

Recommendations For OpenMRS versions 2.9 and prior, consider validating and sanitizing the referrer header value to prevent cross-site scripting attacks. As a temporary workaround, restrict access to the redirectUrl HTML element until a proper fix is applied.

Exploit

Fix

XSS

RCE

Weakness Enumeration

CWE-79

CWE-20

Related Identifiers

CVE-2020-5728

Affected Products

Openmrs

References · 3

• 🔥 https://tenable.com/security/research/tra-2020-18 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-5728 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5728 · Vendor Advisory