CVE-2017-6394: XSS

Published Mar 2, 2017

Updated

Multiple Cross-Site Scripting (XSS) issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to the "openemr-master/gacl/admin/objectsearch.php" URL (sectionvalue; srcform). An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

Affected Software

1 affected component

open-emr Openemr=5.0.1-dev

Event History

Mar 2, 2017

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

Description

Data Sourced

via NVD·06:59 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-6394?

CVE-2017-6394 is classified as a medium severity vulnerability.

How do I fix CVE-2017-6394?

To fix CVE-2017-6394, update OpenEMR to the latest version that addresses these XSS vulnerabilities.

Which versions of OpenEMR are affected by CVE-2017-6394?

CVE-2017-6394 affects OpenEMR versions 5.0.0 and 5.0.1-dev.

What type of vulnerability is CVE-2017-6394?

CVE-2017-6394 is a Cross-Site Scripting (XSS) vulnerability.

Can an attacker exploit CVE-2017-6394 without authentication?

Yes, an attacker can exploit CVE-2017-6394 without requiring authentication to execute arbitrary HTML and script code.