CVE-2021-40374

2022-04-0602:15:08

Google

osv.dev

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.2%

JSON

A stored cross-site scripting (XSS) vulnerability was identified in Apperta Foundation OpenEyes 3.5.1. Updating a patient’s details allows remote attackers to inject arbitrary web script or HTML via the Address1 parameter. This JavaScript then executes when the patient profile is loaded, which could be used in a XSS attack.

CPENameOperatorVersion
openeyeseq1.4.7
openeyeseq1.5.4
openeyeseq1.4.4
openeyeseq1.11.1
openeyeseqarchive/release/1.3-moorfields
openeyeseq2.1.1
openeyeseq1.17
openeyeseq2.0.2
openeyeseq1.4.6
openeyeseq1.16

Name	Operator	Version
openeyes	eq	1.4.7
openeyes	eq	1.5.4
openeyes	eq	1.4.4
openeyes	eq	1.11.1
openeyes	eq	archive/release/1.3-moorfields
openeyes	eq	2.1.1
openeyes	eq	1.17
openeyes	eq	2.0.2
openeyes	eq	1.4.6
openeyes	eq	1.16