CVE-2017-7990

2017-04-2100:59:00

Google

osv.dev

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

40.9%

JSON

The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert JavaScript into a name field in webapp/reports/manageReports.jsp.

CPENameOperatorVersion
openmrs-module-reportingeq0.9.5
openmrs-module-reportingeq0.10.2
openmrs-module-reportingeq0.7.4.1
openmrs-module-reportingeq0.10.0
openmrs-module-reportingeq0.7.6
openmrs-module-reportingeq0.9.2
openmrs-module-reportingeq0.8.2
openmrs-module-reportingeq0.9.0
openmrs-module-reportingeq0.8
openmrs-module-reportingeq0.10.6

Name	Operator	Version
openmrs-module-reporting	eq	0.9.5
openmrs-module-reporting	eq	0.10.2
openmrs-module-reporting	eq	0.7.4.1
openmrs-module-reporting	eq	0.10.0
openmrs-module-reporting	eq	0.7.6
openmrs-module-reporting	eq	0.9.2
openmrs-module-reporting	eq	0.8.2
openmrs-module-reporting	eq	0.9.0
openmrs-module-reporting	eq	0.8
openmrs-module-reporting	eq	0.10.6