Unscored CVE-2017-7990 EUVD-2017-16960GHSA-7wjw-qmg2-hcfv

The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to inser…

Published Apr 21, 2017 · Updated Sep 16, 2024 · Assigned by mitre

Description

The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert JavaScript into a name field in webapp/reports/manageReports.jsp.

References

https://www.youtube.com/watch?v=pfrIaNvIuFY
https://github.com/openmrs/openmrs-module-reporting/pull/141/commits/0023a659288538d2763835847d3414ecb18b931a#diff-50e25eddc5909110fa3d31090877c2fd