Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseGHSA-vpxm-cr3r-pjp9
GHSA-vpxm-cr3r-pjp9:
Java vulnerability analysis and mitigation
Overview
A critical security advisory was issued for OpenMRS on January 30, 2025, following a third-party penetration testing assessment. The vulnerability affects multiple OpenMRS modules including the core platform (versions < 2.6.11), addresshierarchy (versions < 2.19.0), attachments (versions < 3.6.0), idgen (versions < 4.14.0), legacyui (versions < 1.21.0), and patientflags (versions < 3.0.8). The assessment was conducted on the OpenMRS v3 Reference Application (O3 RefApp), though the findings also impact modules commonly used in older OpenMRS applications (GitHub Advisory).
Technical details
The security assessment revealed multiple vulnerabilities including broken access control (leading to inappropriate admin access), phishing vulnerabilities, and stored XSS issues related to vulnerable passwords. The vulnerabilities are tracked under CWE-209, CWE-284, CWE-601, and CWE-614. After implementing fixes, the OpenMRS O3 RefApp achieved a Security Level of 'Excellent, Grade A'. Notably, no vulnerabilities were discovered in the O3 frontend esm modules (GitHub Advisory).
Impact
The vulnerabilities affect all OpenMRS instances and could potentially allow unauthorized administrative access, enable phishing attacks, and exploit stored XSS vulnerabilities. The impact is considered critical, affecting both newer and older OpenMRS applications including the O2 RefApp (GitHub Advisory).
Mitigation and workarounds
Users are strongly recommended to upgrade to the patched versions: Platform 2.6.11+ (or 2.7+), Legacy UI OMOD 1.21.0+, ID Gen OMOD 4.14.0+, Address Hierarchy OMOD 2.19.0+, Attachments OMOD 3.6.0+, and Patient Flags OMOD 3.0.8+. For Bahmni ecosystem users on Platform 2.5+, version 2.5.14 includes the necessary patches. No practical workarounds exist without upgrading, as removing affected OMODs would severely impact system functionality (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management