CVE-2022-2733: OpenEMR reflected XSS before 7.0.0.1

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityThe flaw is remotely reachable without authentication and public exploit material exists with a very high EPSS score, though it requires user interaction and is rated medium severity by CVSS.

What it is

OpenEMR versions prior to 7.0.0.1 contain a reflected cross-site scripting flaw (CWE-79). A crafted request can cause attacker-controlled script to execute in a victim's browser within the OpenEMR origin, which matters because OpenEMR handles clinical and patient data in authenticated sessions.

Impact

An attacker can run script in the victim's browser session, potentially stealing session cookies or tokens and acting with the victim's privileges in the application. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reachable over the network (AV:N) with no authentication required (PR:N), but exploitation requires the victim to trigger the crafted request (UI:R). The record does not name the specific vulnerable endpoint or parameter.

Exploitation

No CISA KEV listing and no ransomware association. EPSS is very high (0.95839, 99.871st percentile) and references carry an Exploit tag, indicating public exploit material exists, though the record does not confirm active in-the-wild use.

What to do

• Upgrade OpenEMR to 7.0.0.1 or later, applying commit 59458bc15ab0cb556c521de9d5187167d6f88945.
• If immediate upgrade is not possible, restrict network access to the OpenEMR instance and review the referenced patch for the affected endpoint to apply targeted input encoding.
• Deploy a WAF or input filtering rule to block script payloads in reflected parameters, treating it as a temporary control only.
• Set session cookies HttpOnly and Secure, and enforce a strict Content-Security-Policy to limit script execution.
• Review logs for suspicious reflected parameters and educate users not to follow untrusted OpenEMR links.

Detection

• Search web and proxy logs for requests containing script tags, event handlers, or encoded script payloads in query strings or parameters to OpenEMR endpoints.
• Monitor for anomalous outbound requests or referrers originating from OpenEMR pages that could indicate script exfiltration.
• Alert on repeated requests from a single source probing OpenEMR parameters with XSS-like patterns.
• Correlate OpenEMR access logs with authentication events for signs of session hijacking after a crafted link is clicked.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.