Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the POST parameter title is reflected back in a JSON response built with json_encode(). Because the response is served with a text/html Content-Type, the browser interprets injected HTML/script tags rather than treating the output as JSON. An authenticated attacker can craft a request that executes arbitrary JavaScript in a victim's session. Version 8.0.0.3 contains a fix.
AnalysisAI
This is a stored/reflected cross-site scripting (XSS) vulnerability in OpenEMR versions prior to 8.0.0.3 where the POST parameter 'title' is improperly encoded in JSON responses but served with a text/html Content-Type header, causing browsers to execute injected JavaScript rather than treat the output as data. An authenticated attacker can craft a malicious request to execute arbitrary JavaScript in a victim's session, potentially leading to session hijacking, credential theft, or unauthorized actions within the electronic health records system. The vulnerability carries a moderate CVSS score of 5.4 but requires authentication and user interaction (UI:R), reducing immediate exploitation likelihood, though a proof-of-concept fix commit is available in the GitHub repository.
Technical ContextAI
The vulnerability stems from improper output encoding in a JSON API endpoint within OpenEMR, an open-source electronic health records and medical practice management application (CPE: cpe:2.3:a:openemr:openemr). The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic cross-site scripting flaw. The issue arises when the 'title' POST parameter is reflected into a JSON response constructed via json_encode(), which produces syntactically valid JSON. However, because the HTTP response is served with Content-Type: text/html instead of application/json, the browser's HTML parser interprets injected HTML and script tags within the JSON structure rather than treating the response as plain data. This represents a content-type mismatch vulnerability where JSON data is mishandled as HTML content, allowing script execution in the victim's security context.
RemediationAI
Upgrade OpenEMR to version 8.0.0.3 or later immediately, as confirmed by the vendor release at https://github.com/openemr/openemr/releases/tag/v8_0_0_3. For environments unable to patch immediately, implement network-level controls by restricting access to OpenEMR administration and user-facing endpoints to trusted IP ranges, enforce HTTPS with HSTS headers to prevent session hijacking, disable JavaScript execution in sensitive administrative interfaces where feasible, and monitor authentication logs for unusual session activity. Additionally, sanitize and validate the 'title' POST parameter input server-side and ensure all JSON responses are served with the correct Content-Type: application/json header to prevent browser HTML interpretation of JSON data.
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today