CVE-2021-25918: XSS
Published Mar 22, 2021
·Updated
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and rendered in the TOTP Authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user.
Affected Software
1 affected component
open-emr Openemr>=5.0.2<=6.0.0
Remediation
Event History
Mar 22, 2021
CVE Published
via MITRE·07:33 PM
Data Sourced
via MITRE·07:33 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-25918?
CVE-2021-25918 has a medium severity rating due to its potential for stored cross-site scripting attacks.
2
How do I fix CVE-2021-25918?
To fix CVE-2021-25918, it is recommended to upgrade OpenEMR to a version higher than 6.0.0.
3
Who is affected by CVE-2021-25918?
CVE-2021-25918 affects OpenEMR versions from 5.0.2 to 6.0.0.
4
What type of vulnerability is CVE-2021-25918?
CVE-2021-25918 is a Stored Cross-Site Scripting (XSS) vulnerability.
5
What could an attacker do with CVE-2021-25918?
A highly privileged attacker could inject arbitrary code into user input fields, compromising the application.