CVE-2024-0875CWE-79

Stored XSS in openemr/openemr

High · published November 15, 2024

CVSS v3.0
8.1
EPSS
0%
Percentile
30.5
In the wild
Unconfirmed
What it is

A stored cross-site scripting (XSS) vulnerability exists in openemr/openemr version 7.0.1. An attacker can inject malicious payloads into the 'inputBody' field in the Secure Messaging feature, which can then be sent to other users. When the recipient views the malicious message, the payload is executed, potentially compromising their account. This issue is fixed in version 7.0.2.1.

The record
Technical detail
CVSS v3.0
8.1 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00377 · 30.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-11-15T10:57Z
EPSS history
Timeline
  • 15 NOV 10:57Z
    Stored XSS in openemr/openemr
    cvelistv5