CVE-2020-5730 In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting

Description

In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting.

Affected products and versions

Product	Affected versions	Fixed in
OpenMRS	Versions not published

Other CVEs of OpenMRS

The 6 CVEs of OpenMRS →

CVE-2020-5731 In OpenMRS 2.9 and prior, the app parameter for the ActiveVisit's page is vulnerable to cross-site scripting Not rated CVE-2020-5729 In OpenMRS 2.9 and prior, the UI Framework Error Page reflects arbitrary, user-supplied input back to the browser, which… Not rated CVE-2020-5728 OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages… Not rated CVE-2020-5733 In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly redirect to a login… Not rated