Cross-site Scripting in OpenCRX
Date: 2023-11
Affected: maven/org.opencrx:opencrx-core-models
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2023-40809
CVE-2023-40810
CVE-2023-40812
CVE-2023-40813
CVE-2023-40814
CVE-2023-40815
CVE-2023-40816
CVE-2023-40817
CWE: CWE-79
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field.


Mitigations:

Architectural layers (MAESTRO):