← Vulnerability feed

Vulnerability record · CVE-2014-8073 · published 23 October 2014

CVE-2014-8073: Openmrs cross-site request forgery vulnerability

Openmrs · Openmrs

Cross-site request forgery (CSRF) vulnerability in OpenMRS 2.1 Standalone Edition allows remote attackers to hijack the authentication of administrators for requests that add a new user via a Save User action to admin/users/user.form.

6.8 CVSS 2.0 Medium EPSS 1.1% · top 36.8% CWE-352 · Cross-site request forgery
6.8CVSS 2.0 base score
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Cross-site request forgery (CSRF) vulnerability in OpenMRS 2.1 Standalone Edition allows remote attackers to hijack the authentication of administrators for requests that add a new user via a Save User action to admin/users/user.form.

AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/128748/OpenMRS-2.1-Access-Bypass-XSS-CSRF.html Exploit
http://www.securityfocus.com/bid/70664
https://exchange.xforce.ibmcloud.com/vulnerabilities/97692
http://packetstormsecurity.com/files/128748/OpenMRS-2.1-Access-Bypass-XSS-CSRF.html Exploit
http://www.securityfocus.com/bid/70664
https://exchange.xforce.ibmcloud.com/vulnerabilities/97692

Track CVE-2014-8073 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-43094Openmrs sql injection vulnerabilityAn SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone Edition <=2.4.0 via GET requ…EPSS 1.3%9.8CVE-2018-19276OpenMRS insecure XML deserialization allows unauthenticated RCEOpenMRS before 2.24.0 deserializes untrusted XML data from request bodies without adequate validation, exposing an insecure object deserialization fl…EPSS 99%analysed9.8CVE-2017-12796Openmrs deserialization of untrusted data vulnerabilityThe Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate user…EPSS 4.2%9.4CVE-2026-40076Openmrs path traversal vulnerabilityOpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the module …EPSS 0.90%8.2CVE-2026-40075Openmrs path traversal vulnerabilityOpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the `/openm…EPSS 0.72%8.0CVE-2025-25928Openmrs cross-site request forgery vulnerabilityA Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary opera…EPSS 0.28%7.5CVE-2022-23612Openmrs path traversal vulnerabilityOpenMRS is a patient-based medical record system focusing on giving providers a free customizable electronic medical record system. Affected versions…EPSS 1.9%6.8CVE-2025-25927Openmrs cross-site request forgery vulnerabilityA Cross-Site Request Forgery (CSRF) in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request.EPSS 0.26%

Source: NIST National Vulnerability Database (record CVE-2014-8073), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.