CVE-2020-5728: 
OpenMRS - Standalone Edition vulnerability analysis and mitigation

OpenMRS version 2.9 and prior versions contain a cross-site scripting (XSS) vulnerability identified as CVE-2020-5728. The vulnerability was discovered in January 2020 and publicly disclosed in April 2020. The issue affects the application's handling of 'Referrer' header values, which are copied into an HTML element named 'redirectUrl' within multiple webpages, including login.htm (Tenable Advisory).

The vulnerability stems from insufficient validation of the 'Referrer' header values when they are copied into the 'redirectUrl' HTML element. This implementation flaw allows for the possibility of cross-site scripting attacks. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating that it is network-accessible, requires low attack complexity, needs no privileges, but does require user interaction (NVD).

The vulnerability could allow attackers to execute cross-site scripting attacks, potentially leading to the compromise of user sessions, theft of sensitive information, or manipulation of web content. The CVSS scoring indicates low impact on both confidentiality and integrity, with no impact on availability (NVD).

The vulnerability can be exploited by manipulating the 'Referrer' header in HTTP requests to affected pages. A proof-of-concept exploit has been documented that demonstrates the vulnerability using a curl command to send a malicious Referrer header (Tenable Advisory).

Users should upgrade to a version of OpenMRS newer than 2.9.0 to address this vulnerability. The issue affects all versions up to and including 2.9.0 (NVD).