CVE-2020-5733: 
OpenMRS - Standalone Edition vulnerability analysis and mitigation

In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module contains a significant security vulnerability. The issue allows unauthenticated users to access the export functionality without proper login page redirection, potentially exposing sensitive information (Tenable Advisory, NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The CVSS v2.0 Base Score is 5.8 (Medium) with the vector (AV:N/AC:M/Au:N/C:P/I:P/A:N). The vulnerability is classified under CWE-601 (URL Redirection to Untrusted Site) (NVD).

When exploited, this vulnerability allows unauthorized users to export potentially sensitive information directly by accessing the URL path '/module/dataexchange/export.form'. This poses a significant risk to data confidentiality as sensitive patient information could be exposed to unauthorized parties (Tenable Advisory).

The vulnerability can be exploited by directly accessing the export functionality URL without authentication. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N) (Tenable Advisory).

Users are advised to upgrade to the latest supported version of OpenMRS that contains fixes for this vulnerability. The issue was disclosed to OpenMRS on January 6, 2020, and fixes were deployed by April 5, 2020 (Tenable Advisory).