VulnerabilityAnalyzed

CVE-2024-0875

A stored cross-site scripting (XSS) vulnerability exists in openemr/openemr version 7.0.1.

MEDIUM 4.8EPSS 0.38%

Does this matter?

Lower severity and a low EPSS score (0.38%). Track it; it rarely justifies an emergency change on its own.

Description

A stored cross-site scripting (XSS) vulnerability exists in openemr/openemr version 7.0.1. An attacker can inject malicious payloads into the 'inputBody' field in the Secure Messaging feature, which can then be sent to other users. When the recipient views the malicious message, the payload is executed, potentially compromising their account. This issue is fixed in version 7.0.2.1.

CVSS 3.1: 4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.38% probability · 31th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: open-emr/openemr
Source: security@huntr.dev

References

https://github.com/openemr/openemr/commit/d141d2ca06fb2171a202c7302dd5d5af8539f255Patch
https://huntr.com/bounties/16cba0fc-748d-4ea8-9573-1f6fbe9a27c9Exploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.