CVE-2024-0875

CVSS V2 None CVSS V3 None

Description

A stored cross-site scripting (XSS) vulnerability exists in openemr/openemr version 7.0.1. An attacker can inject malicious payloads into the 'inputBody' field in the Secure Messaging feature, which can then be sent to other users. When the recipient views the malicious message, the payload is executed, potentially compromising their account. This issue is fixed in version 7.0.2.1.

Overview

CVE ID
CVE-2024-0875

Assigner
@huntr_ai

Vulnerability Status
PUBLISHED

Published Version
2024-11-15T10:57:25.334Z

Last Modified Date
2024-11-15T20:54:38.603Z

Weakness Enumerations

CWE	URL
CWE-79	http://cwe.mitre.org/data/definitions/79.html

References

Reference URL	Reference Tags
https://huntr.com/bounties/16cba0fc-748d-4ea8-9573-1f6fbe9a27c9
https://github.com/openemr/openemr/commit/d141d2ca06fb2171a202c7302dd5d5af8539f255

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-0875
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0875

History

Created	Old Value	New Value	Data Type	Notes
2024-11-16 13:40:33				Added to TrackCVE