Not rated
CVE-2020-5728 OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages…
Description
OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (such as login.htm). There is insufficient validation for this parameter, which allows for the possibility of cross-site scripting.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenMRS | Versions not published |
Other CVEs of OpenMRS
The 6 CVEs of OpenMRS →
CVE-2020-5731
In OpenMRS 2.9 and prior, the app parameter for the ActiveVisit's page is vulnerable to cross-site scripting
Not rated
CVE-2020-5730
In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting
Not rated
CVE-2020-5729
In OpenMRS 2.9 and prior, the UI Framework Error Page reflects arbitrary, user-supplied input back to the browser, which…
Not rated
CVE-2020-5733
In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly redirect to a login…
Not rated