CVE-2025-25928: CSRF

Published Mar 11, 2025

Updated

A Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request. In this case, an attacker could elevate a low-privileged account to an administrative role by leveraging the CSRF vulnerability at the /admin/users/user.form endpoint.

Affected Software

2 affected components

OpenMRS Openmrs

OpenMRS Openmrs=2.4.3

Event History

Mar 11, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-25928?

CVE-2025-25928 has been rated as a high severity vulnerability due to its potential to allow unauthorized actions by exploiting Cross-Site Request Forgery.

How do I fix CVE-2025-25928?

To fix CVE-2025-25928, it is recommended to update OpenMRS to a version that addresses the CSRF vulnerability.

What component is affected by CVE-2025-25928?

CVE-2025-25928 affects the /admin/users/user.form component of OpenMRS version 2.4.3.

What attacks can be performed using CVE-2025-25928?

Using CVE-2025-25928, attackers can execute arbitrary operations through carefully crafted GET requests.

Who is affected by CVE-2025-25928?

Users of OpenMRS version 2.4.3 are at risk from CVE-2025-25928 if they have not implemented necessary security measures.