PT-2022-11778 · Openmrs · Openmrs Platform Standalone Edition+1

Published 2022-05-10 · Updated 2022-05-17 · CVE-2021-43094

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenMRS Reference Application Standalone Edition versions 2.11 and earlier OpenMRS Platform Standalone Edition versions 2.4.0 and earlier

Description An SQL Injection issue exists via GET requests on arbitrary parameters in the patient.page. This allows for potential exploitation.

Recommendations For OpenMRS Reference Application Standalone Edition versions 2.11 and earlier, update to a version later than 2.11 to resolve the issue. For OpenMRS Platform Standalone Edition versions 2.4.0 and earlier, update to a version later than 2.4.0 to resolve the issue. As a temporary workaround, consider restricting access to the patient.page until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-43094

Affected Products

Openmrs Platform Standalone Edition

Openmrs Reference Application Standalone Edition

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-43094 · Security Note
• https://wiki.openmrs.org/display/docs/Reporting+Bugs · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43094 · Vendor Advisory
• https://issues.openmrs.org/browse/TRUNK-6043 · Vendor Advisory
• https://t.me/cibsecurity/42236 · Telegram Post
• https://openmrs.org/demo · Note