CVE-2020-5732

MEDIUM

OpenMRS < 2.9.0 - Unauthenticated Open Redirect via Data Exchange Module Import

Title source: llm
STIX 2.1

Description

In OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it. This allows unauthenticated users to use a feature typically restricted to administrators.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://www.tenable.com/security/research/tra-2020-18

Scores

CVSS v3 6.1
EPSS 0.0118
EPSS Percentile 63.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-601
Status published
Products (1)
openmrs/openmrs < 2.9.0
Published Apr 17, 2020
Tracked Since Feb 18, 2026