Cross site request forgery (csrf)

2017-04-2100:59:00

PRIOn knowledge base

www.prio-n.com

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.8%

JSON

The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert JavaScript into a name field in webapp/reports/manageReports.jsp.

CPENameOperatorVersion
openmrs_module_reportingeq1.12.0

CPE	Name	Operator	Version
	openmrs_module_reporting	eq	1.12.0

References

github.com/openmrs/openmrs-module-reporting/pull/141/commits/0023a659288538d2763835847d3414ecb18b931a

www.youtube.com/watch?v=pfrIaNvIuFY