CVE-2022-31492

Name of the Vulnerable Software and Affected Versions LibreHealth EHR Base version 2.0.0

Description The issue is related to a Cross Site scripting (XSS) vulnerability. It affects the interface/usergroup/usergroup admin add.php file, specifically the Username field. This vulnerability can be exploited via the "/interface/usergroup/usergroup admin add.php" API endpoint, allowing for potential XSS attacks through the Username variable.

Recommendations For LibreHealth EHR Base version 2.0.0, consider disabling the usergroup admin add.php function until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to the interface/usergroup/usergroup admin add.php file to minimize the risk of exploitation. Avoid using the Username variable in the affected API endpoint until the issue is resolved.