Vulnerability Details CVE-2021-25918
In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and rendered in the TOTP Authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.028
EPSS Ranking 85.5%
CVSS Severity
CVSS v3 Score 4.8
CVSS v2 Score 3.5
References
- https://github.com/openemr/openemr/commit/0fadc3e592d84bc9dfe9e0403f8bd6e3c7d8427f
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25918
- https://github.com/openemr/openemr/commit/0fadc3e592d84bc9dfe9e0403f8bd6e3c7d8427f
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25918
Products affected by CVE-2021-25918
-
cpe:2.3:a:open-emr:openemr:5.0.2
-
cpe:2.3:a:open-emr:openemr:5.0.2.1
-
cpe:2.3:a:open-emr:openemr:5.0.2.2
-
cpe:2.3:a:open-emr:openemr:5.0.2.3
-
cpe:2.3:a:open-emr:openemr:5.0.2.4
-
cpe:2.3:a:open-emr:openemr:5.0.2.5
-
cpe:2.3:a:open-emr:openemr:6.0.0