CVE-2022-4727 is a cross-site scripting (XSS) vulnerability found in the OpenMRS Appointment Scheduling Module, specifically affecting versions up to 1.16.x. This flaw, located in the 'getNotes' function within the 'AppointmentRequest.java' file, allows remote attackers to inject malicious scripts by manipulating the 'notes' argument. Rated as a medium severity vulnerability with a CVSS score of 6.1, it has a low attack complexity and requires user interaction, potentially leading to limited impact on confidentiality and integrity. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE. Upgrading to version 1.17.0 or applying patch 2ccbe39c020809765de41eeb8ee4c70b5ec49cc8 is recommended to remediate this issue.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.17.0CPE matchmatch criteria | cpe:2.3:a:openmrs:appointment_scheduling_module:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.