CVE-2022-1179: OpenEMR low-privilege rule creation leads to stored XSS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityPublic exploit material and a very high EPSS score raise the likelihood of exploitation despite the medium CVSS base score.

What it is

OpenEMR before 6.0.0.4 lets a non-privileged authenticated user create a new rule that stores script content, resulting in stored cross-site scripting. Because the payload persists in the application and is served to other users, it can execute in the browsers of staff who view the affected rule.

Impact

An attacker with a low-privilege account can run script in the context of other users' sessions, potentially stealing session data or performing actions as the victim. The CVSS scope change indicates impact can extend beyond the vulnerable component.

Attack surface

Reached over the network through the rule creation functionality; the vector requires low privileges (PR:L) and user interaction (UI:R) from the victim who views the stored content. No unauthenticated access is implied.

Exploitation

Not listed in CISA KEV, but EPSS is 0.769 (99.5th percentile) and references include an Exploit tag, indicating public exploit material exists. No ransomware association is documented.

What to do

• Upgrade OpenEMR to 6.0.0.4 or later, applying commit 347ad614507183035d188ba14427bc162419778c.
• Restrict rule-creation permissions to only the roles that require them.
• Sanitize and encode user-supplied rule content on input and output.
• Deploy a content security policy that limits inline script execution.
• Review existing rules for injected script content and remove any found.

Detection

• Search OpenEMR rule records and logs for script tags or event-handler attributes in rule content.
• Monitor for low-privilege accounts creating rules, especially outside normal workflows.
• Alert on outbound requests or session anomalies originating from OpenEMR pages rendering rules.
• Review web logs for requests to rule endpoints with encoded script payloads.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.