OpenMRS Appointment Scheduling Module Notes AppointmentRequest.java getNotes cross site scripting

A vulnerability, which was classified as problematic, was found in OpenMRS Appointment Scheduling Module up to 1.16.x. This affects the function getNotes of the file api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java of the component Notes Handler. The manipulation of the argument notes leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.17.0 is able to address this issue. The name of the patch is 2ccbe39c020809765de41eeb8ee4c70b5ec49cc8. It is recommended to upgrade the affected component. The identifier VDB-216741 was assigned to this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

对消息或数据结构的处理不恰当

OpenMRS 跨站脚本漏洞

OpenMRS是美国OpenMRS公司的一套开源的电子病历系统。 OpenMRS 1.17.0之前版本存在安全漏洞，该漏洞源于组件Notes Handler中api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java文件的函数getNotes存在问题，对参数notes操作会导致跨站脚本。

N/A

N/A