CVE-2020-36635: XSS in OpenMRS Appointment Scheduling Module

Successful exploitation of CVE-2020-36635 allows an attacker to inject arbitrary JavaScript code into the OpenMRS Appointment Scheduling Module. This code can then be executed in the context of a user's browser, potentially granting the attacker access to sensitive information such as session cookies. An attacker could leverage this to impersonate legitimate users, modify data, or redirect users to malicious websites. The impact is amplified if the OpenMRS instance handles Protected Health Information (PHI), as attackers could potentially steal or manipulate this data. While the CVSS score is LOW, the potential for user compromise and data exposure warrants immediate attention.

1. Reserved2022-12-27
2. Published2022-12-27
3. Modified2025-04-11
4. EPSS updated2026-04-02

The primary mitigation for CVE-2020-36635 is to upgrade the OpenMRS Appointment Scheduling Module to version 1.13.0 or later. This version includes a fix for the vulnerable code. If immediate upgrading is not possible, consider implementing input validation and output encoding on the validateFieldName function to sanitize user-supplied data. While not a complete solution, this can reduce the attack surface. Review and strengthen web application firewall (WAF) rules to detect and block XSS attempts targeting the appointment scheduling API. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload (e.g., <script>alert('XSS')</script>) through the appointment scheduling API and verifying that it is properly sanitized.