CVE-2014-8071 Cross-site scripting in n/a
Remote attackers can inject arbitrary scripts via multiple parameters in OpenMRS, potentially stealing data or hijacking sessions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2014-8071?
CVE-2014-8071 is a medium-severity cross-site scripting vulnerability in n/a, published on 23 Oct 2014. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Multiple cross-site scripting (XSS) vulnerabilities in OpenMRS 2.1 Standalone Edition allow remote attackers to inject arbitrary web script or HTML via the (1) givenName, (2) familyName, (3) address1, or (4) address2 parameter to registrationapp/registerPatient.page; the (5) comment parameter to allergyui/allergy.page; the (6) w10 parameter to htmlformentryui/htmlform/enterHtmlForm/submit.action; the (7) HTTP Referer Header to login.htm; the (8) returnUrl parameter to htmlformentryui/htmlform/enterHtmlFormWithStandardUi.page or (9) coreapps/mergeVisits.page; or the (10) visitId parameter to htmlformentryui/htmlform/enterHtmlFormWithSimpleUi.page.
Weakness: CWE-79
Which versions are affected by CVE-2014-8071?
It affects 1 product.
Products include Openmrs Openmrs.
How do I fix CVE-2014-8071?
No fix has been published for CVE-2014-8071 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2014-8071 being exploited?
There is no known exploitation of CVE-2014-8071 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2018-19276 Deserialization in n/a
- CVE-2021-43094 SQL injection in n/a
- CVE-2017-12796 Deserialization in n/a
- CVE-2026-40076 OpenMRS Core arbitrary file write and code execution via Zip Slip in module upload
- CVE-2026-40075 OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServlet
Sources
Also known as GHSA-3ccj-h5mc-8965.