CVE-2024-0875: Stored XSS in openemr/openemr
First published: Fri Nov 15 2024(Updated: )
A stored cross-site scripting (XSS) vulnerability exists in openemr/openemr version 7.0.1. An attacker can inject malicious payloads into the 'inputBody' field in the Secure Messaging feature, which can then be sent to other users. When the recipient views the malicious message, the payload is executed, potentially compromising their account. This issue is fixed in version 7.0.2.1.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenEMR | =7.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-0875?
CVE-2024-0875 is classified as a medium severity stored cross-site scripting (XSS) vulnerability.
How can I mitigate the risk posed by CVE-2024-0875?
To mitigate CVE-2024-0875, users should sanitize input fields to prevent script injection in the Secure Messaging feature.
Which version of OpenEMR is affected by CVE-2024-0875?
CVE-2024-0875 affects OpenEMR version 7.0.1.
Can CVE-2024-0875 lead to data breaches?
Yes, CVE-2024-0875 can potentially lead to data breaches by allowing attackers to execute malicious scripts in users' browsers.
Is there a fix available for CVE-2024-0875?
A fix for CVE-2024-0875 should be incorporated into an updated version of OpenEMR, so upgrading to the latest version is recommended.
- agent/title
- agent/references
- agent/weakness
- agent/first-publish-date
- agent/type
- agent/description
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/open-emr
- canonical/openemr
- version/openemr/7.0.1