CVE-2020-5728: Input Validation
OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (such as login.htm). There is insufficient validation for this parameter, which allows for the possibility of cross-site scripting.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-5728?
CVE-2020-5728 is classified as a medium severity vulnerability due to the potential for cross-site scripting attacks.
How do I fix CVE-2020-5728?
To fix CVE-2020-5728, update OpenMRS to a version later than 2.9.0 where the vulnerability has been addressed.
Can CVE-2020-5728 be exploited remotely?
Yes, CVE-2020-5728 can be exploited remotely by attackers who can manipulate the "Referrer" header.
What impact does CVE-2020-5728 have on user data?
CVE-2020-5728 can lead to unauthorized script execution, compromising user data integrity and confidentiality.
Is CVE-2020-5728 a known vulnerability in OpenMRS?
Yes, CVE-2020-5728 is a recognized vulnerability in OpenMRS versions 2.9 and prior.