CVE-2023-2947: OpenEMR stored XSS before 7.0.1

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

medium priorityCVSS is medium (4.8) and exploitation requires a privileged account plus victim interaction, though the high EPSS and public exploit reference warrant prompt patching.

What it is

OpenEMR versions prior to 7.0.1 contain a stored cross-site scripting flaw (CWE-79). An attacker who can inject script content into data that is later rendered to other users can execute code in their browsers, which matters in a clinical system where sessions carry sensitive patient data.

Impact

An attacker can run arbitrary script in the browser of a victim user, potentially stealing session cookies or acting as that user within OpenEMR. The CVSS scope change (S:C) indicates the impact can extend beyond the vulnerable component.

Attack surface

Reached over the network (AV:N) but requires high privileges (PR:H) to plant the payload and user interaction (UI:R) for the victim to trigger it. No authentication bypass is implied; the attacker must already hold a privileged account.

Exploitation

No CISA KEV listing and no ransomware association. EPSS is very high (0.904, 99.8th percentile) and a public exploit reference exists, but the record does not confirm active exploitation.

What to do

• Upgrade OpenEMR to 7.0.1 or later, applying commit 8d2d601ac40aca75bcd2c3cf193f59c8e56d8425.
• If immediate upgrade is not possible, restrict privileged accounts and review who can enter data rendered to other users.
• Enforce output encoding and input sanitization on stored fields, and deploy a Content Security Policy to limit script execution.
• Set session cookies HttpOnly and SameSite to reduce session theft impact.
• Audit privileged accounts for unauthorized or unexpected changes.

Detection

• Search application and web logs for script tags or event handler attributes in submitted form fields.
• Monitor for anomalous authenticated sessions or requests originating from unexpected locations.
• Review stored records for injected markup in fields that are displayed to other users.
• Alert on access to the vulnerable endpoint by accounts that do not normally use it.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.