OpenMRS Appointment Scheduling Module AppointmentTypeValidator.java validateFieldName cross site scripting

Successful exploitation of CVE-2020-36635 allows an attacker to inject arbitrary JavaScript code into the OpenMRS Appointment Scheduling Module. This code can then be executed in the context of a user's browser, potentially granting the attacker access to sensitive information such as session cookies. An attacker could leverage this to impersonate legitimate users, modify data, or redirect users to malicious websites. The impact is amplified if the OpenMRS instance handles Protected Health Information (PHI), as attackers could potentially steal or manipulate this data. While the CVSS score is LOW, the potential for user compromise and data exposure warrants immediate attention.

Healthcare organizations and clinics utilizing OpenMRS with the Appointment Scheduling Module versions 1.0 through 1.12.x are at risk. Specifically, deployments that handle sensitive patient data or rely on the appointment scheduling module for critical functionality are particularly vulnerable. Shared hosting environments running OpenMRS are also at increased risk due to potential cross-tenant vulnerabilities.

• linux / server: Monitor OpenMRS application logs for suspicious JavaScript injection attempts. Use grep to search for patterns like <script or onerror=.

grep -i '<script' /var/log/openmrs/application.log

• generic web: Use curl to test the appointment scheduling API endpoints with various payloads and observe the response for signs of script execution.

curl -X POST -d '<script>alert("XSS")</script>' <appointment_scheduling_api_endpoint>

1. 2022-12-27Disclosure

   disclosure

1. Reserviert2022-12-27
2. Veröffentlicht2022-12-27
3. Geändert2025-04-11
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2020-36635 is to upgrade the OpenMRS Appointment Scheduling Module to version 1.13.0 or later. This version includes a fix for the vulnerable code. If immediate upgrading is not possible, consider implementing input validation and output encoding on the validateFieldName function to sanitize user-supplied data. While not a complete solution, this can reduce the attack surface. Review and strengthen web application firewall (WAF) rules to detect and block XSS attempts targeting the appointment scheduling API. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload (e.g., <script>alert('XSS')</script>) through the appointment scheduling API and verifying that it is properly sanitized.