CVE-2021-4291 - CVE House

Back to Database

Status published Low CVE-2021-4291

OpenMRS Admin UI Module location.gsp cross site scripting

3.5 CVSS

Vulnerability Description

A vulnerability was found in OpenMRS Admin UI Module up to 1.5.x. It has been declared as problematic. This vulnerability affects unknown code of the file omod/src/main/webapp/pages/metadata/locations/location.gsp. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.6.0 is able to address this issue. The name of the patch is a7eefb5f69f6c50a3bffcb138bb8ea57cb41a9b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216916.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-4291

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from OpenMRS

View All →

OpenMRS Appointment Scheduling Module Notes AppointmentRequest.java getNotes cross site scripting

OpenMRS Admin UI Module Manage Privilege Page privilege.gsp cross site scripting

OpenMRS openmrs-module-referenceapplication User App Page UserAppPageController.java post cross site scripting

OpenMRS openmrs-module-referenceapplication userApp.gsp cross site scripting

OpenMRS HTML Form Entry UI Framework Integration Module cross site scripting

Affected Vendor

OpenMRS

View all reports →

Affected Software

Admin UI Module

Vulnerable Versions:

1.0, 1.1, 1.2, 1.3, 1.4, 1.5

Timeline

Official Publish: December 27th, 2022

Last Modified: August 3rd, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement