LOWCVE-2020-36636CVSS 3.5

CVE-2020-36636: XSS in OpenMRS Admin UI Module

Platform

java

Component

openmrs-module-adminui

Fixed in

1.0.1

1.1.1

1.2.1

1.3.1

1.4.1

AI Confidence: highNVDEPSS 0.3%Reviewed: May 2026

View on NVD

Save

CVE-2020-36636 describes a problematic cross-site scripting (XSS) vulnerability discovered in the OpenMRS Admin UI Module. This flaw resides within the sendErrorMessage function of the AccountPageController.java file, allowing attackers to inject malicious scripts. The vulnerability affects versions 1.0 through 1.4 of the module and can be exploited remotely. A fix is available in version 1.5.0.

Impact and Attack Scenarios

Successful exploitation of CVE-2020-36636 allows an attacker to inject arbitrary JavaScript code into the OpenMRS Admin UI Module. This can lead to a variety of malicious outcomes, including session hijacking, phishing attacks, and defacement of the administrative interface. An attacker could potentially steal sensitive user credentials, modify system configurations, or gain unauthorized access to patient data stored within the OpenMRS system. The impact is particularly severe given the module's role in managing user accounts and system settings within the OpenMRS platform.

Exploitation Context

CVE-2020-36636 was publicly disclosed in December 2022. There is no indication of active exploitation campaigns targeting this vulnerability at this time. No public proof-of-concept (PoC) code has been widely released, but the nature of XSS vulnerabilities makes it likely that a PoC could be developed relatively easily. This vulnerability is not currently listed on the CISA KEV catalog.

Threat Intelligence

Exploit Status

Proof of ConceptUnknown

CISA KEVNO

Internet ExposureHigh

EPSS

0.29% (52% percentile)

CVSS Vector

Affected Software

Componentopenmrs-module-adminui

VendorOpenMRS

Affected rangeFixed in

1.0 – 1.01.0.1

1.1 – 1.11.1.1

1.2 – 1.21.2.1

1.3 – 1.31.3.1

1.4 – 1.41.4.1

Weakness Classification (CWE)

CWE-79

Timeline

Reserved2022-12-27
Published2022-12-27
Modified2024-08-04
EPSS updated2026-04-02

Mitigation and Workarounds

The primary mitigation for CVE-2020-36636 is to upgrade the OpenMRS Admin UI Module to version 1.5.0 or later. This version includes a patch (702fbfdac7c4418f23bb5f6452482b4a88020061) that addresses the vulnerability. If immediate upgrading is not feasible, consider implementing input validation and output encoding on user-supplied data within the sendErrorMessage function as a temporary workaround. While not a complete solution, this can reduce the attack surface. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload into the error message field and verifying that it is properly sanitized and does not execute.

How to fix

Actualice el módulo Admin UI a la versión 1.5.0 o posterior. Esta versión contiene una corrección para la vulnerabilidad de cross-site scripting. La actualización se puede realizar a través del administrador de módulos de OpenMRS.

CVE Security Newsletter

Vulnerability analysis and critical alerts directly to your inbox.

Frequently asked questions

What is CVE-2020-36636 — XSS in OpenMRS Admin UI Module?

CVE-2020-36636 is a cross-site scripting (XSS) vulnerability affecting OpenMRS Admin UI Module versions 1.0 through 1.4, allowing attackers to inject malicious scripts.

Am I affected by CVE-2020-36636 in OpenMRS Admin UI Module?

You are affected if you are using OpenMRS Admin UI Module versions 1.0, 1.1, 1.2, 1.3, or 1.4. Upgrade to version 1.5.0 or later to mitigate the risk.

How do I fix CVE-2020-36636 in OpenMRS Admin UI Module?

Upgrade the OpenMRS Admin UI Module to version 1.5.0 or later. The patch identifier is 702fbfdac7c4418f23bb5f6452482b4a88020061.

Is CVE-2020-36636 being actively exploited?

There is currently no evidence of active exploitation campaigns targeting CVE-2020-36636, but the vulnerability's nature makes it a potential target.

Where can I find the official OpenMRS advisory for CVE-2020-36636?

Refer to the OpenMRS security advisories for detailed information and updates regarding CVE-2020-36636: [https://www.openmrs.org/security/](https://www.openmrs.org/security/)

NextGuard

Vulnerabilities

What do these metrics mean?

Attack Vector: Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
Attack Complexity: Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
Privileges Required: Low — any valid user account is sufficient. Basic authenticated access required.
User Interaction: Required — victim must take an action: open a file, click a link, or visit a crafted page.
Scope: Unchanged — impact is limited to the vulnerable component itself.
Confidentiality: None — no confidentiality impact. Attacker cannot read protected data.
Integrity: Low — attacker can modify some data with limited scope or impact.
Availability: None — no availability impact. Service remains fully operational.

Is your project affected?

Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.

Scan free Search CVEs

Java / Maven

Detect this CVE in your project

Upload your pom.xml file and we'll tell you instantly if you're affected.

Upload pom.xmlSupported formats: pom.xml · build.gradle