CVE-2022-4727

Low

Description

A vulnerability, which was classified as problematic, was found in OpenMRS Appointment Scheduling Module up to 1.16.x. This affects the function getNotes of the file api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java of the component Notes Handler. The manipulation of the argument notes leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.17.0 is able to address this issue. The name of the patch is 2ccbe39c020809765de41eeb8ee4c70b5ec49cc8. It is recommended to upgrade the affected component. The identifier VDB-216741 was assigned to this vulnerability.

SeverityLow

CVSS3.5

Exploit probability—

ProductOpenmrs Appointment Scheduling Module

PublishedDec 27, 2022

First seenDec 27, 2022

Weakness typeCWE-707CWE-707

How to fix

Update

openmrs appointment_scheduling_module1.17.0 or later

Affected products

Product	Affected versions	Fixed in
openmrs appointment_scheduling_module	v < 1.17.0	1.17.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.