CVE-2019-8368: OpenEMR 5.0.1-6 cross-site scripting flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityAlthough CVSS is only 6.1, the EPSS score is near the top percentile and public exploit references exist, and the target is a clinical system holding sensitive data.

What it is

OpenEMR v5.0.1-6 is affected by a cross-site scripting (XSS) vulnerability, per a third-party advisory that also covers remote code execution in the same release. The record gives no detail on the specific parameter or page involved, so the exact injection point is unknown from the supplied facts. Because OpenEMR handles clinical data, script execution in a victim's session can expose protected health information.

Impact

An attacker can run script in the context of a logged-in OpenEMR user, enabling session theft, credential capture, or actions performed as that user. The CVSS scope change (S:C) means the impact can extend beyond the vulnerable component.

Attack surface

Network-reachable over HTTP/HTTPS with no privileges required (PR:N), but exploitation requires the victim to trigger the crafted request or page (UI:R). No authentication is needed to deliver the payload, though the target must be a user with an active session for meaningful impact.

Exploitation

Not listed in CISA KEV, but EPSS is 0.45881 (98.7th percentile), indicating high predicted exploitation activity. Both references are tagged Exploit and Third Party Advisory, so public exploit detail exists.

What to do

• Upgrade OpenEMR to a release later than v5.0.1-6 that fixes the XSS issue.
• If immediate upgrade is not possible, apply output encoding and input validation on all user-supplied parameters, and deploy a WAF rule set targeting reflected and stored XSS.
• Enforce HttpOnly and Secure flags on session cookies to limit script-based session theft.
• Restrict network exposure of the OpenEMR instance to trusted networks or place it behind a VPN.
• Review the Bishop Fox advisory for the specific vulnerable endpoint and test it directly.

Detection

• Search web and application logs for requests containing script tags or event-handler payloads (e.g., <script>, onerror=, onload=) targeting OpenEMR endpoints.
• Monitor for anomalous authenticated sessions, including sudden IP or user-agent changes and requests to administrative functions.
• Alert on outbound connections or page loads to unfamiliar external domains from OpenEMR clients, which may indicate script exfiltration.
• Review OpenEMR audit logs for unexpected record access or configuration changes following suspicious page requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.