A stored cross-site scripting vulnerability in OpenEMR versions prior to 8.0.0.3 allows authenticated attackers to compromise clinician browser sessions via malicious CCDA documents.

This is a stored cross-site scripting (CWE-79) vulnerability occurring within the CCDA document preview feature. An authenticated attacker with the ability to upload or send a CCDA document can inject malicious JavaScript, which executes when a clinician previews the document due to improper sanitization of the linkHtml element.

The successful exploitation of this vulnerability could lead to unauthorized actions performed on behalf of a clinician, potentially resulting in the theft of sensitive patient data, session hijacking, or unauthorized modifications to electronic health records. With a CVSS score of 7.6, this flaw poses a significant risk to the integrity and confidentiality of medical practice management systems.

Immediate Action: Upgrade your OpenEMR installation to version 8.0.0.3 or later to apply the necessary sanitization patch.

Proactive Monitoring: Audit access logs for unusual document upload activity or unexpected script execution patterns within the clinician user interface.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of inline scripts and ensure that only trusted domains can load external resources.

Public Exploit Available: Unknown

Given that this vulnerability allows for the execution of arbitrary code within the context of a clinician's browser, it represents a high risk to patient data privacy and system security. Organizations currently running OpenEMR versions earlier than 8.0.0.3 should prioritize the immediate application of the vendor-supplied update to eliminate this vector for session and data compromise.