CVE-2021-43094

An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone Edition <=2.4.0 via GET requests on arbitrary parameters in patient.page.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 72%
VendorProductVersion
openmrsopenmrs
𝑥
≤ 2.4.0
openmrsreference_application
𝑥
≤ 2.11
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://issues.openmrs.org/browse/TRUNK-6043
https://openmrs.org/demo/
https://wiki.openmrs.org/display/docs/Reporting+Bugs
https://issues.openmrs.org/browse/TRUNK-6043
https://openmrs.org/demo/
https://wiki.openmrs.org/display/docs/Reporting+Bugs