PT-2024-15883 · Openemr · Openemr

Published 2024-11-15 · Updated 2024-11-19 · CVE-2024-0875

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions openemr/openemr version 7.0.1

Description A stored cross-site scripting (XSS) issue exists in the Secure Messaging feature. An attacker can inject malicious payloads into the inputBody field, which can then be sent to other users. When the recipient views the malicious message, the payload is executed, potentially compromising their account.

Recommendations For version 7.0.1, update to version 7.0.2.1 to resolve the issue. As a temporary workaround, consider restricting access to the Secure Messaging feature or disabling the ability to input data into the inputBody field until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-0875

Affected Products

Openemr

References · 7

• 🔥 https://huntr.com/bounties/16cba0fc-748d-4ea8-9573-1f6fbe9a27c9 · Exploit
• https://github.com/openemr/openemr/commit/d141d2ca06fb2171a202c7302dd5d5af8539f255 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-0875 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0875 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1857440676822061217 · Twitter Post
• https://twitter.com/CVEnew/status/1857381715200950283 · Twitter Post
• https://t.me/cvedetector/11059 · Telegram Post