What is CVE-2020-5728?

CVE-2020-5728 is a medium-severity vulnerability in Openmrs, classified under Improper Input Validation. CVSS score: 6.1/10. Published 2020-04-17.

How severe is CVE-2020-5728?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Openmrs

CVE-2020-5728

OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (such as login.htm). There is insufficient validation for this parameter, which allows for the possibility of cross-site scripting.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.011 (63.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Openmrs
N/a Openmrs — versions Versions 2.90 and prior

Weakness classification (CWE)

CWE-20 — Improper Input Validation
CWE-79 — Cross-site Scripting

References

vulnreport@tenable.com (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-5728?: CVE-2020-5728 is a medium-severity vulnerability in Openmrs, classified under Improper Input Validation. CVSS score: 6.1/10. Published 2020-04-17.
How severe is CVE-2020-5728?: Medium severity. CVSS v3 base score is 6.1 out of 10.