CVE-2024-0875: Stored XSS in openemr/openemr
A stored cross-site scripting (XSS) vulnerability exists in openemr/openemr version 7.0.1. An attacker can inject malicious payloads into the 'inputBody' field in the Secure Messaging feature, which can then be sent to other users. When the recipient views the malicious message, the payload is executed, potentially compromising their account. This issue is fixed in version 7.0.2.1.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0875?
CVE-2024-0875 is classified as a medium severity stored cross-site scripting (XSS) vulnerability.
How can I mitigate the risk posed by CVE-2024-0875?
To mitigate CVE-2024-0875, users should sanitize input fields to prevent script injection in the Secure Messaging feature.
Which version of OpenEMR is affected by CVE-2024-0875?
CVE-2024-0875 affects OpenEMR version 7.0.1.
Can CVE-2024-0875 lead to data breaches?
Yes, CVE-2024-0875 can potentially lead to data breaches by allowing attackers to execute malicious scripts in users' browsers.
Is there a fix available for CVE-2024-0875?
A fix for CVE-2024-0875 should be incorporated into an updated version of OpenEMR, so upgrading to the latest version is recommended.