Non notée
CVE-2020-5728 OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages…
Description
OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (such as login.htm). There is insufficient validation for this parameter, which allows for the possibility of cross-site scripting.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| OpenMRS | Versions non publiées |
Autres CVE de OpenMRS
Les 6 CVE de OpenMRS →
CVE-2020-5731
In OpenMRS 2.9 and prior, the app parameter for the ActiveVisit's page is vulnerable to cross-site scripting
Non notée
CVE-2020-5730
In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting
Non notée
CVE-2020-5729
In OpenMRS 2.9 and prior, the UI Framework Error Page reflects arbitrary, user-supplied input back to the browser, which…
Non notée
CVE-2020-5733
In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly redirect to a login…
Non notée