CVE-2021-25917: XSS
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and rendered in the U2F USB Device authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-25917?
CVE-2021-25917 is a vulnerability in OpenEMR versions 5.0.2 to 6.0.0 that allows for stored Cross-Site Scripting (XSS) attacks.
How does CVE-2021-25917 work?
CVE-2021-25917 works by not properly validating and rendering user input in the U2F USB Device authentication method page, allowing an attacker to inject arbitrary code.
What is the severity of CVE-2021-25917?
CVE-2021-25917 has a severity level of medium with a CVSS score of 4.8 (out of 10).
What software versions are affected by CVE-2021-25917?
Versions 5.0.2 to 6.0.0 of OpenEMR are affected by CVE-2021-25917.
How can I fix CVE-2021-25917?
To fix CVE-2021-25917, it is recommended to update OpenEMR to a version that includes the necessary security patches.