Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenticated attacker could craft a malicious form that, when submitted by a victim, executes arbitrary JavaScript in the victim's browser session. Version 8.0.0.3 patches the issue.
AnalysisAI
OpenEMR versions prior to 8.0.0.3 contain a stored cross-site scripting (XSS) vulnerability in form handling that allows authenticated attackers to inject malicious JavaScript into forms, which executes in the browser sessions of victims who submit those forms. An attacker with valid OpenEMR credentials can craft a malicious form that, upon submission by any user, executes arbitrary JavaScript with the privileges of the victim's session, potentially leading to session hijacking, credential theft, or unauthorized actions within the electronic health records system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Vulnerability AssessmentAI
| Risk Assessment | The CVSS 3.1 score of 5.4 reflects a Medium severity rating with specific vector characteristics: Network attack vector (AV:N) means remote exploitation is possible, Low complexity (AC:L) indicates no special conditions needed, Low privilege requirement (PR:L) mandates prior authentication, and Required user interaction (UI:R) necessitates victim action. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A disgruntled healthcare staff member with valid OpenEMR credentials crafts a malicious patient intake form containing JavaScript that steals session tokens and forwards them to an attacker-controlled server. When a physician victim submits or reviews this form, the injected script silently executes in their authenticated browser session, allowing the attacker to assume the physician's identity and access sensitive patient records, modify medical histories, or intercept prescriptions. … |
| Remediation | Immediately upgrade OpenEMR to version 8.0.0.3 or later, which includes patches for form input sanitization and output encoding as detailed in the official release (https://github.com/openemr/openemr/releases/tag/v8_0_0_3). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today