CVE-2021-4292

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability was found in OpenMRS Admin UI Module up to 1.4.x. It has been rated as problematic. This issue affects some unknown processing of the file omod/src/main/webapp/pages/metadata/privileges/privilege.gsp of the component Manage Privilege Page. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.5.0 is able to address this issue. The name of the patch is 4f8565425b7c74128dec9ca46dfbb9a3c1c24911. It is recommended to upgrade the affected component. The identifier VDB-216917 was assigned to this vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
OpenMRS	Admin UI Module	1.0; 1.1; 1.2; 1.3; 1.4

References

https://github.com/openmrs/openmrs-module-adminui/commit/4f8565425b7c74128dec9ca46dfbb9a3c1c24911Patch, Third Party Advisory
https://github.com/openmrs/openmrs-module-adminui/pull/58Patch, Third Party Advisory
https://github.com/openmrs/openmrs-module-adminui/releases/tag/1.5.0Release Notes, Third Party Advisory
https://vuldb.com/?ctiid.216917Permissions Required, Third Party Advisory
https://vuldb.com/?id.216917Third Party Advisory
https://github.com/openmrs/openmrs-module-adminui/commit/4f8565425b7c74128dec9ca46dfbb9a3c1c24911Patch, Third Party Advisory
https://github.com/openmrs/openmrs-module-adminui/pull/58Patch, Third Party Advisory
https://github.com/openmrs/openmrs-module-adminui/releases/tag/1.5.0Release Notes, Third Party Advisory
https://vuldb.com/?ctiid.216917Permissions Required, Third Party Advisory
https://vuldb.com/?id.216917Third Party Advisory

Timeline

Published: Dec 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-429237.3ShowMyPC 3606 on Windows suffers from a DLL hijack vulnerability. If an attacker overwrites the file %temp%\ShowMyPC\-ShowMyPC3606\wodVPN.dl CVE-2021-42936.1** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in gnuboard youngcart5 up to 5.4.5.1. Affected is a CVE-2021-42945.9A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClien CVE-2021-429409.9A Cross Site Scripting (XSS) vulnerability exists in Projeqtor 9.3.1 via /projeqtor/tool/saveAttachment.php, which allows an attacker to upl CVE-2021-429435.4Stored cross-site scripting (XSS) in admin/usermanager.php over IPPlan v4.92b allows remote attackers to inject arbitrary web script or HTML CVE-2021-429459.8A SQL Injection vulnerability exists in ZZCMS 2021 via the askbigclassid parameter in /admin/ask.php.CVE-2021-429464.8A Cross Site Scripting (XSS) vulnerability exists in htmly.2.8.1 via the Copyright field in the /admin/config page.CVE-2021-429483.7HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, al CVE-2021-429499.8The component controlla_login function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attack CVE-2021-42959.8A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabula CVE-2021-429508.8Remote Code Execution (RCE) vulnerability exists in Zepl Notebooks all previous versions before October 25 2021. Users can register for an a CVE-2021-429518.8A Remote Code Execution (RCE) vulnerability exists in Algorithmia MSOL all versions before October 10 2021 of SaaS. Users can register for a