CVE-2020-5728 Cross-site scripting in OpenMRS
Attackers can inject malicious scripts via the Referrer header in OpenMRS, potentially leading to session hijacking or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-5728?
CVE-2020-5728 is a medium-severity cross-site scripting vulnerability in OpenMRS, published on 17 Apr 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (such as login.htm). There is insufficient validation for this parameter, which allows for the possibility of cross-site scripting.
Which versions are affected by CVE-2020-5728?
It affects 1 product.
Products include Openmrs Openmrs.
How do I fix CVE-2020-5728?
No fix has been published for CVE-2020-5728 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-5728 being exploited?
There is no known exploitation of CVE-2020-5728 in the wild and no public exploit code.
Other vulnerabilities in OpenMRS
- CVE-2018-19276 Deserialization in n/a
- CVE-2021-43094 SQL injection in n/a
- CVE-2017-12796 Deserialization in n/a
- CVE-2026-40076 OpenMRS Core arbitrary file write and code execution via Zip Slip in module upload
- CVE-2026-40075 OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServlet
Sources
Also known as GHSA-mv2x-9h7w-52q7.