CVE-2021-25919: XSS
Published Mar 22, 2021
·Updated
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly. A highly privileged attacker could inject arbitrary code into input fields when creating a new user.
Affected Software
1 affected component
open-emr Openemr>=5.0.2<=6.0.0
Remediation
Event History
Mar 22, 2021
CVE Published
via MITRE·07:22 PM
Data Sourced
via MITRE·07:22 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-25919?
CVE-2021-25919 has a medium severity rating due to the potential for an attacker to execute arbitrary scripts.
2
How do I fix CVE-2021-25919?
To fix CVE-2021-25919, update OpenEMR to a version later than 6.0.0 where the vulnerability has been addressed.
3
What systems are affected by CVE-2021-25919?
CVE-2021-25919 affects OpenEMR versions 5.0.2 to 6.0.0.
4
What type of vulnerability is CVE-2021-25919?
CVE-2021-25919 is classified as a Stored Cross-Site Scripting (XSS) vulnerability.
5
Who can exploit CVE-2021-25919?
A highly privileged attacker can exploit CVE-2021-25919 by injecting arbitrary code into user input fields.