Reflected XSS Vulnerability in OpenEMR by OpenEMR Community
CVE-2023-22972

5.4MEDIUM

Key Information:

Vendor

Open-emr

Status
Openemr
Vendor
CVE Published:
22 February 2023

What is CVE-2023-22972?

A reflected cross-site scripting vulnerability exists in OpenEMR versions prior to 7.0.0, allowing remote authenticated users to inject malicious web scripts or HTML code through the REQUEST_URI parameter. This vulnerability could potentially lead to unauthorized actions being executed on behalf of the victim, compromising the integrity and confidentiality of the application’s users.

References

https://www.open-emr.org/wiki/index.php/OpenEMR_Patches#7...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.