Medium severity · published Nov 15, 2024
CVE-2024-0875
Stored XSS in openemr/openemr
4.8
CVSS
0.4%
EPSS
No
On KEV
Description
A stored cross-site scripting (XSS) vulnerability exists in openemr/openemr version 7.0.1. An attacker can inject malicious payloads into the 'inputBody' field in the Secure Messaging feature, which can then be sent to other users. When the recipient views the malicious message, the payload is executed, potentially compromising their account. This issue is fixed in version 7.0.2.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openemr/openemr · openemr
before 7.0.2.1 · source: vendor
OP
Openemr · Open-emr
7.0.1 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-0875
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-0875
Patch
https://github.com/openemr/openemr/commit/d141d2ca06fb2171a202c7302dd5d5af8539f255
Exploit
https://huntr.com/bounties/16cba0fc-748d-4ea8-9573-1f6fbe9a27c9
More from openemr/openemr
8.8
CVE-2023-2943
Code Injection in openemr/openemr
8.3
CVE-2022-2732
Missing Authorization in openemr/openemr
8.1
CVE-2023-2950
Improper Authorization in openemr/openemr
8.1
CVE-2023-2946
Improper Access Control in openemr/openemr
8.1
CVE-2023-2942
Improper Input Validation in openemr/openemr