Security Digest · Critical advisory (no CVE assigned)
GHSA-vpxm-cr3r-pjp9: General OpenMRS Security Advisory, January 2025: Penetration Testing Results and Patches
Impact We recently underwent Penetration Testing of OpenMRS by a third-party company.
GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
mvn dependency:tree -Dincludes=<groupId>:<artifactId>. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Maven | org.openmrs:openmrs | < 2.6.11 | 2.6.11 |
| Maven | org.openmrs.module:legacyui | < 1.21.0 | 1.21.0 |
| Maven | org.openmrs.module:idgen | < 4.14.0 | 4.14.0 |
| Maven | org.openmrs.module:addresshierarchy | < 2.19.0 | 2.19.0 |
| Maven | org.openmrs.module:attachments | < 3.6.0 | 3.6.0 |
| Maven | org.openmrs.module:patientflags | < 3.0.8 | 3.0.8 |
Details
Impact We recently underwent Penetration Testing of OpenMRS by a third-party company. Vulnerabilities were found, and fixes have been made and released. We've released security updates that include critical fixes, and so, we strongly recommend upgrading affected modules.
This notice applies to all OpenMRS instances. The testers used the OpenMRS v3 Reference Application (O3 RefApp); however, their findings highlighted modules commonly used in older OpenMRS applications, including the O2 RefApp.
Vulnerability Details - The issues uncovered included broken access control (e.g. inappropriate admin access), phishing vulnerability, and stored XSS (e.g. vulnerable passwords). - No vulnerabilities were found in the O3 frontend esm modules. - The Letter of Attestation from the penetration test is available here for your reference. - After the fixes were applied, the OpenMRS O3 RefApp met a Security Level of “Excellent, Grade A”. - The full detailed Remediation Pentest Report is available to Implementation Technical Leads upon request.
Patches Minimum Requirements for Implementers: We strongly recommend upgrading your modules to the following versions (or greater) as soon as possible. This is the minimum amount to do and be protected from the vulnerabilities found and fixed. The following versions contain the patch:
- Platform 2.6.11+ - How: Increase your platform version number wherever this is specified in your implementation. If you use the OpenMRS SDK, this will be in the distro.properties file. - Notes: - The newly released Platform 2.7 also includes the fixes. Release Notes and more download options here. - Platform 2.6.8+ has most of the fixes, but these are broken if you don't use SSL, so Platform 2.6.11 or higher is preferred. - For those still on Platform 2.5+ such as the Bahmni ecosystem, the new 2.5.14 release includes the patch. Bahmni note: The upcoming patch release for both Bahmni Lite and Bahmni Standard will incorporate these security fixes. - Legacy UI OMOD 1.21.0+…
Sources and references
- GitHub Advisory GHSA-vpxm-cr3r-pjp9 github.com
- github.com github.com