In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting.
https://www.tenable.com/security/research/tra-2020-18
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5730
In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting.
https://www.tenable.com/security/research/tra-2020-18
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5730