PT-2022-11734 · Openmrs · Openmrs

The-Lady · Published 2022-12-27 · Updated 2024-05-17 · CVE-2021-4289

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenMRS openmrs-module-referenceapplication versions up to 2.11.x

Description A vulnerability was found in the function post of the file omod/src/main/java/org/openmrs/module/referenceapplication/page/controller/UserAppPageController.java of the component User App Page. The manipulation of the argument AppId leads to cross-site scripting. The attack can be launched remotely. Upgrading to version 2.12.0 is able to address this issue.

Recommendations For OpenMRS openmrs-module-referenceapplication versions up to 2.11.x, upgrade to version 2.12.0 to address the issue. As a temporary workaround, consider restricting access to the UserAppPageController.java file or disabling the post function until the upgrade is applied. Avoid using the AppId argument in the affected component until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-4289

Affected Products

Openmrs

References · 11

• https://github.com/openmrs/openmrs-module-referenceapplication/pull/89 · Patch
• https://github.com/openmrs/openmrs-module-referenceapplication/releases/tag/referenceapplication-2.12.0 · Patch
• https://github.com/openmrs/openmrs-module-referenceapplication/commit/0410c091d46eed3c132fe0fcafe5964182659f74 · Patch
• https://osv.dev/vulnerability/CVE-2021-4289 · Vendor Advisory
• https://issues.openmrs.org/browse/RA-1875 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4289 · Security Note
• https://t.me/cvenotify/40777 · Telegram Post
• https://vuldb.com/?id.216883 · Note
• https://t.me/cibsecurity/55399 · Telegram Post
• https://t.me/cvenotify/41382 · Telegram Post
• https://vuldb.com/?ctiid.216883 · Note