CVE-2025-25928
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-25928
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-25928.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-25928
- Published
- 2025-03-11T20:15:17Z
- Modified
- 2025-10-22T10:06:38.220702Z
- Severity
-
- 8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
A Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request. In this case, an attacker could elevate a low-privileged account to an administrative role by leveraging the CSRF vulnerability at the /admin/users/user.form endpoint.
- References
Affected packages
Git / github.com/openmrs/openmrs-core
Affected ranges
- Type
- GIT
- Repo
- https://github.com/openmrs/openmrs-core
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affected
Affected versions
1.*
1.1.0
1.10.0-alpha
1.2.0
1.2.01
1.2.01-RC1
1.3.0-RC1
1.3.0-RC2
1.3.0-RC3
1.3.0-RC4
1.9.0-RC
1.9.0-RC2
1.9.0-RC3
1.9.0-RC4
1.9.0-alpha
1.9.0-beta
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
2.*
2.2.0-20181112.082045-243
2.4.0
2.4.0-alpha.2
2.4.0-alpha.3
2.4.0-beta
2.4.1
2.4.2
2.4.3
Other
mirebalais_deploy_version