{"answers":{"affected":"12 open source packages ship an affected version, including org.openmrs.module:addresshierarchy, org.openmrs.module:attachments and org.openmrs.module:idgen.","exploited":"There is no known exploitation of GHSA-vpxm-cr3r-pjp9 in the wild and no public exploit code.","fix":"Upgrade org.openmrs.module:addresshierarchy to 2.19.0 or later.","what":"GHSA-vpxm-cr3r-pjp9 is a cross-site scripting vulnerability in org.openmrs.module:addresshierarchy, published on 30 Jan 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-vpxm-cr3r-pjp9 and fix it if it is affected.\n\nWhat it is: GHSA-vpxm-cr3r-pjp9 is a cross-site scripting vulnerability in org.openmrs.module:addresshierarchy, published on 30 Jan 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-vpxm-cr3r-pjp9 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- org.openmrs.module:addresshierarchy (Maven): affected all versions; fixed in 2.19.0\n- org.openmrs.module:addresshierarchy (Maven): affected all versions; fixed in 2.19.0\n- org.openmrs.module:attachments (Maven): affected all versions; fixed in 3.6.0\n- org.openmrs.module:attachments (Maven): affected all versions; fixed in 3.6.0\n- org.openmrs.module:idgen (Maven): affected all versions; fixed in 4.14.0\n- org.openmrs.module:idgen (Maven): affected all versions; fixed in 4.14.0\n- org.openmrs.module:legacyui (Maven): affected all versions; fixed in 1.21.0\n- org.openmrs.module:legacyui (Maven): affected all versions; fixed in 1.21.0\n- org.openmrs.module:patientflags (Maven): affected all versions; fixed in 3.0.8\n- org.openmrs.module:patientflags (Maven): affected all versions; fixed in 3.0.8\n- org.openmrs:openmrs (Maven): affected all versions; fixed in 2.6.11\n- org.openmrs:openmrs (Maven): affected all versions; fixed in 2.6.11\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-vpxm-cr3r-pjp9/ (Markdown: https://insights.sbomify.com/GHSA-vpxm-cr3r-pjp9/index.md)","id":"GHSA-vpxm-cr3r-pjp9","markdown":"https://insights.sbomify.com/GHSA-vpxm-cr3r-pjp9/index.md","name":"GHSA-vpxm-cr3r-pjp9","record":{"aliases":[],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_read","account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"OpenMRS health platform","requires_auth":"low_privilege","summary":"Attackers can exploit stored XSS and broken access control in OpenMRS to steal data or take over accounts, requiring immediate module upgrades.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\nWe recently underwent Penetration Testing of OpenMRS by a third-party company. **Vulnerabilities were found, and fixes have been made and released.** We've released security updates that include critical fixes, and so, we strongly recommend upgrading affected modules.\n\n**This notice applies to _all_ OpenMRS instances.** The testers used the OpenMRS v3 Reference Application (O3 RefApp); however, their findings highlighted modules commonly used in older OpenMRS applications, including the O2 RefApp. \n\n## Vulnerability Details\n- The issues uncovered included broken access control (e.g. inappropriate admin access), phishing vulnerability, and stored XSS (e.g. vulnerable passwords).\n- No vulnerabilities were found in the O3 frontend esm modules. \n- The Letter of Attestation from the penetration test is [available here](https://drive.google.com/file/d/1sBm4-FzLA8hSoM9wYknBfgEttBHyLvoU/view?usp=sharing) for your reference. \n- After the fixes were applied, the OpenMRS O3 RefApp met a Security Level of “Excellent, Grade A”.\n- The full detailed Remediation Pentest Report is available to Implementation Technical Leads upon request.\n\n### Patches\n**Minimum Requirements for Implementers:** We **strongly** recommend upgrading your modules to the following versions (or greater) as soon as possible. **This is the minimum amount to do and be protected from the vulnerabilities found and fixed.** The following versions contain the patch: \n\n- **Platform** 2.6.11+ \n  - How: Increase your platform version number wherever this is specified in your implementation. If you use the OpenMRS SDK, this will be in the distro.properties file.\n  - Notes: \n    - The newly released [**Platform 2.7**](https://sourceforge.net/projects/openmrs/files/releases/OpenMRS_Platform_2.7.0/) also includes the fixes. [Release Notes and more download options here](https://openmrs.atlassian.net/wiki/x/XoBzEQ).\n    - Platform 2.6.8+ has most of the fixes, but these are broken if you don't use SSL, so Platform 2.6.11 or higher is preferred.\n    - For those still on Platform 2.5+ such as the Bahmni ecosystem, the new [2.5.14](https://ci.openmrs.org/browse/TRUNK-CORE2-232) release includes the patch. _Bahmni note: The upcoming patch release for both Bahmni Lite and Bahmni Standard will incorporate these security fixes._\n- **Legacy UI** OMOD 1.21.0+ ([here](https://addons.openmrs.org/show/org.openmrs.module.legacyui))\n- **ID Gen** OMOD 4.14.0+ ([here](https://addons.openmrs.org/show/org.openmrs.module.idgen))\n- **Address Hierarchy** OMOD 2.19.0+ ([here](https://addons.openmrs.org/show/org.openmrs.module.addresshierarchy))\n- **Attachments** OMOD 3.6.0+ ([here](https://addons.openmrs.org/show/org.openmrs.module.attachments))\n- **Patient Flags** OMOD 3.0.8+ ([here](https://addons.openmrs.org/show/org.openmrs.module.patientflags))\n\n### Workarounds\nThere are no practical workarounds to fix or remediate the vulnerabilities without upgrading. Technically, you could remove the affected OMODs, but this would badly degrade the system's functionality.\n\n## Thank you to our amazing Security contributors!\nThank you to security firm UnderDefense, and to the OpenMRS Security Group contributors for their patch support - specific thanks to Daniel Kayiwa, Samuel Lubwama, Ian Bacher, Rafal Korytkowski, and Michael Seaton.","ecosystems":["Maven"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"General OpenMRS Security Advisory, January 2025: Penetration Testing Results and Patches","id":"GHSA-vpxm-cr3r-pjp9","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Maven","product":null,"products":[],"type":"xss","year":"2025"},"n_packages":12,"n_references":null,"packages":[{"ecosystem":"Maven","fixed":["2.19.0"],"introduced":["0"],"last_affected":[],"package":"org.openmrs.module:addresshierarchy","purl":null,"source":"GHSA-vpxm-cr3r-pjp9"},{"ecosystem":"Maven","fixed":["2.19.0"],"introduced":["0"],"last_affected":[],"package":"org.openmrs.module:addresshierarchy","purl":"pkg:maven/org.openmrs.module/addresshierarchy","source":"GHSA-vpxm-cr3r-pjp9"},{"ecosystem":"Maven","fixed":["3.6.0"],"introduced":["0"],"last_affected":[],"package":"org.openmrs.module:attachments","purl":null,"source":"GHSA-vpxm-cr3r-pjp9"},{"ecosystem":"Maven","fixed":["3.6.0"],"introduced":["0"],"last_affected":[],"package":"org.openmrs.module:attachments","purl":"pkg:maven/org.openmrs.module/attachments","source":"GHSA-vpxm-cr3r-pjp9"},{"ecosystem":"Maven","fixed":["4.14.0"],"introduced":["0"],"last_affected":[],"package":"org.openmrs.module:idgen","purl":null,"source":"GHSA-vpxm-cr3r-pjp9"},{"ecosystem":"Maven","fixed":["4.14.0"],"introduced":["0"],"last_affected":[],"package":"org.openmrs.module:idgen","purl":"pkg:maven/org.openmrs.module/idgen","source":"GHSA-vpxm-cr3r-pjp9"},{"ecosystem":"Maven","fixed":["1.21.0"],"introduced":["0"],"last_affected":[],"package":"org.openmrs.module:legacyui","purl":null,"source":"GHSA-vpxm-cr3r-pjp9"},{"ecosystem":"Maven","fixed":["1.21.0"],"introduced":["0"],"last_affected":[],"package":"org.openmrs.module:legacyui","purl":"pkg:maven/org.openmrs.module/legacyui","source":"GHSA-vpxm-cr3r-pjp9"},{"ecosystem":"Maven","fixed":["3.0.8"],"introduced":["0"],"last_affected":[],"package":"org.openmrs.module:patientflags","purl":null,"source":"GHSA-vpxm-cr3r-pjp9"},{"ecosystem":"Maven","fixed":["3.0.8"],"introduced":["0"],"last_affected":[],"package":"org.openmrs.module:patientflags","purl":"pkg:maven/org.openmrs.module/patientflags","source":"GHSA-vpxm-cr3r-pjp9"},{"ecosystem":"Maven","fixed":["2.6.11"],"introduced":["0"],"last_affected":[],"package":"org.openmrs:openmrs","purl":null,"source":"GHSA-vpxm-cr3r-pjp9"},{"ecosystem":"Maven","fixed":["2.6.11"],"introduced":["0"],"last_affected":[],"package":"org.openmrs:openmrs","purl":"pkg:maven/org.openmrs/openmrs","source":"GHSA-vpxm-cr3r-pjp9"}],"products":null,"published":"2025-01-30","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can exploit stored XSS and broken access control in OpenMRS to steal data or take over accounts, requiring immediate module upgrades.","url":"https://insights.sbomify.com/GHSA-vpxm-cr3r-pjp9/"}