UnratedMavenPublished
General OpenMRS Security Advisory, January 2025: Penetration Testing Results and Patches
GHSA-vpxm-cr3r-pjp9
- Affected
- Maven org.openmrs.module:attachments < 3.6.0
- Fixed in
- 3.6.0· Vendor fix available
- Issue
- Impact We recently underwent Penetration Testing of OpenMRS by a third-party company. Vulnerabilities were found, and fixes have been made and released. We've released security updates that include critical fixes, and so, we strongly recommend upgrading affected modules. This notice applies to all OpenMRS instances. The testers used the OpenMRS v3 Reference Application (O3 RefApp); however, their findings highlighted modules commonly used in older OpenMRS applications, including the O2 RefApp. Vulnerability Details - The issues uncovered included broken access control (e.g. inappropriate admin access), phishing vulnerability, and stored XSS (e.g. vulnerable passwords). - No vulnerabilities were found in the O3 frontend esm modules. - The Letter of Attestation from the penetration test is available here for your reference. - After the fixes were applied, the OpenMRS O3 RefApp met a Security Level of “Excellent, Grade A”. - The full detailed Remediation Pentest Report is available to…
Recommended action: Upgrade to 3.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.