CVE-2020-5728

Name of the Vulnerable Software and Affected Versions OpenMRS versions 2.9 and prior

Description The issue concerns insufficient validation of the referrer header value, which is copied into an HTML element named redirectUrl within various webpages, such as login.htm. This insufficient validation allows for the possibility of cross-site scripting.

Recommendations For OpenMRS versions 2.9 and prior, consider validating and sanitizing the referrer header value to prevent cross-site scripting attacks. As a temporary workaround, restrict access to the redirectUrl HTML element until a proper fix is applied.