Stored Cross-Site Scripting (XSS) Vulnerability in OpenEMR

CVE-2024-0875

What is CVE-2024-0875?

A stored cross-site scripting vulnerability is present in the OpenEMR application, specifically in the Secure Messaging feature of version 7.0.1. This vulnerability allows an attacker to inject harmful scripts into the 'inputBody' field. When users receive a message containing the malicious payload and view it, the payload is executed in their browser. This can lead to unauthorized access and potential compromise of user accounts. To mitigate this vulnerability, upgrading to version 7.0.2.1 or later is essential.

References