CVE-2020-13565: Medium severity openemr vulnerability

Published Feb 10, 2021

Updated

An open redirect vulnerability exists in the returnpage redirection functionality of phpGACL 3.3.7, OpenEMR 5.0.2 and OpenEMR development version 6.0.0 (commit babec93f600ff1394f91ccd512bcad85832eb6ce). A specially crafted HTTP request can redirect users to an arbitrary URL. An attacker can provide a crafted URL to trigger this vulnerability.

Affected Software

2 affected components

open-emr Openemr=5.0.2

Phpgacl Project Phpgacl=3.3.7

Event History

Feb 10, 2021

CVE Published

via MITRE·07:55 PM

Data Sourced

via MITRE·07:55 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2020-13565?

CVE-2020-13565 is an open redirect vulnerability that exists in the return_page redirection functionality of phpGACL 3.3.7, OpenEMR 5.0.2, and OpenEMR development version 6.0.0.

How does CVE-2020-13565 affect OpenEMR and phpGACL?

CVE-2020-13565 affects OpenEMR version 5.0.2 and phpGACL version 3.3.7.

What is the severity of CVE-2020-13565?

The severity of CVE-2020-13565 is medium, with a CVSS base score of 6.1.

How does the open redirect vulnerability work?

A specially crafted HTTP request can redirect users to an arbitrary URL.

Is there a fix available for CVE-2020-13565?

Currently, there is no available fix for CVE-2020-13565. It is recommended to follow the vendor's advisory for any updates or patches.