OpenMRS O3 Security Dashboard

⚠️ Memory Management Failures Highest CVSS: 10.0 — CRITICAL Max CVSS trend: 0.0 -

12 passed / 8 failed · 20 tests ▼

Failed Tests 8 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Integer overflow of quantity on billing page	browser_name: chromium quantity: 2147483648 billing_category: Antenatal care	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	FAIL	10.0 Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 2147483648 has wrapped around to -2147483648 assert -2147483648 == 2147483648	CRITICAL	20.32s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 2147483648 billing_category: Orthopedic Service	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	FAIL	10.0 Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 2147483648 has wrapped around to -2147483648 assert -2147483648 == 2147483648	CRITICAL	20.36s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 2147483648 billing_category: Nutrition counseling	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	FAIL	10.0 Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 2147483648 has wrapped around to -2147483648 assert -2147483648 == 2147483648	CRITICAL	20.29s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 2147483648 billing_category: OPD consultation	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	FAIL	10.0 Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 2147483648 has wrapped around to -2147483648 assert -2147483648 == 2147483648	CRITICAL	20.32s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 4294967294 billing_category: Antenatal care	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	FAIL	10.0 Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 4294967294 has wrapped around to -2 assert -2 == 4294967294	CRITICAL	20.33s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 4294967294 billing_category: Orthopedic Service	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	FAIL	10.0 Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 4294967294 has wrapped around to -2 assert -2 == 4294967294	CRITICAL	20.32s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 4294967294 billing_category: Nutrition counseling	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	FAIL	10.0 Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 4294967294 has wrapped around to -2 assert -2 == 4294967294	CRITICAL	20.42s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 4294967294 billing_category: OPD consultation	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	FAIL	10.0 Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 4294967294 has wrapped around to -2 assert -2 == 4294967294	CRITICAL	20.44s

Passed Tests 12 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Integer overflow of quantity on billing page	browser_name: chromium quantity: 1 billing_category: Antenatal care	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	21.49s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 1 billing_category: Orthopedic Service	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.43s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 1 billing_category: Nutrition counseling	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.36s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 1 billing_category: OPD consultation	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.36s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 1000000 billing_category: Antenatal care	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.25s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 1000000 billing_category: Orthopedic Service	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.37s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 1000000 billing_category: Nutrition counseling	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.4s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 1000000 billing_category: OPD consultation	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.42s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 2147483647 billing_category: Antenatal care	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.38s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 2147483647 billing_category: Orthopedic Service	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.3s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 2147483647 billing_category: Nutrition counseling	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.31s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 2147483647 billing_category: OPD consultation	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.33s

⚠️ Security Misconfiguration Highest CVSS: 8.2 — HIGH Max CVSS trend: 0.0 -

28 passed / 4 failed · 32 tests ▼

Failed Tests 4 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Security header attribute 'unsafe-eval' should not be used for default-src directive on login page	attribute: 'unsafe-eval'	The content-security-policy header should not have unsafe- attributes for the default-src directive	FAIL	8.2 Recorded Errors assert attribute not in security_policy_dict["default-src"] assert "'unsafe-eval'" not in ["'self'", "'unsafe-inline'", "'unsafe-eval'", 'localhost', 'localhost:*']	HIGH	0.19s
Security header attribute 'unsafe-inline' should not be used for default-src directive on login page	attribute: 'unsafe-inline'	The content-security-policy header should not have unsafe- attributes for the default-src directive	FAIL	8.2 Recorded Errors assert attribute not in security_policy_dict["default-src"] assert "'unsafe-inline'" not in ["'self'", "'unsafe-inline'", "'unsafe-eval'", 'localhost', 'localhost:*']	HIGH	0.2s
Security header directive form-action should be set to 'none' or 'self' on login page	directive: form-action fallback: False	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	FAIL	8.2 Recorded Errors assert is_directive_secure == True assert False == True	HIGH	0.19s
*Security header directive form-action should not be set to or http: on login page**	directive: form-action fallback: False	Directives should not be set to * or http: on login page if it exists and falls back to default-src	FAIL	8.2 Recorded Errors assert is_directive_secure == True assert False == True	HIGH	0.19s

Passed Tests 28 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Security header attribute 'unsafe-hash' should not be used for default-src directive on login page	attribute: 'unsafe-hash'	The content-security-policy header should not have unsafe- attributes for the default-src directive	PASS	8.2	HIGH	0.2s
Security header directive default-src should be set to 'none' or 'self' on login page	directive: default-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.2s
Security header directive script-src should be set to 'none' or 'self' on login page	directive: script-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.2s
Security header directive style-src should be set to 'none' or 'self' on login page	directive: style-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.2s
Security header directive connect-src should be set to 'none' or 'self' on login page	directive: connect-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.19s
Security header directive media-src should be set to 'none' or 'self' on login page	directive: media-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.2s
Security header directive object-src should be set to 'none' or 'self' on login page	directive: object-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.2s
Security header directive frame-src should be set to 'none' or 'self' on login page	directive: frame-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.2s
Security header directive worker-src should be set to 'none' or 'self' on login page	directive: worker-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.21s
Security header directive manifest-src should be set to 'none' or 'self' on login page	directive: manifest-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.19s
Security header directive child-src should be set to 'none' or 'self' on login page	directive: child-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.2s
Security header directive font-src should be set to 'none' or 'self' on login page	directive: font-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.19s
Security header directive frame-ancestors should be set to 'none' or 'self' on login page	directive: frame-ancestors fallback: False	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.19s
Security header directive base-uri should be set to 'none' or 'self' on login page	directive: base-uri fallback: False	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.19s
*Security header directive default-src should not be set to or http: on login page**	directive: default-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.19s
*Security header directive script-src should not be set to or http: on login page**	directive: script-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.2s
*Security header directive style-src should not be set to or http: on login page**	directive: style-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.19s
*Security header directive connect-src should not be set to or http: on login page**	directive: connect-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.18s
*Security header directive media-src should not be set to or http: on login page**	directive: media-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.18s
*Security header directive object-src should not be set to or http: on login page**	directive: object-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.18s
*Security header directive frame-src should not be set to or http: on login page**	directive: frame-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.18s
*Security header directive worker-src should not be set to or http: on login page**	directive: worker-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.18s
*Security header directive manifest-src should not be set to or http: on login page**	directive: manifest-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.22s
*Security header directive child-src should not be set to or http: on login page**	directive: child-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.2s
*Security header directive font-src should not be set to or http: on login page**	directive: font-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.19s
*Security header directive frame-ancestors should not be set to or http: on login page**	directive: frame-ancestors fallback: False	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.19s
*Security header directive base-uri should not be set to or http: on login page**	directive: base-uri fallback: False	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.18s
Security header x-content-type-options is set to nosniff on login page	N/A	Files are run using the content type because nosniff is set for the header x-content-type-options	PASS	4.8	MEDIUM	0.19s

⚠️ Insecure Design Highest CVSS: 6.4 — MEDIUM Max CVSS trend: 0.0 -

3 passed / 3 failed · 6 tests ▼

Failed Tests 3 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Appointments should be blocked after reaching max load	browser_name: chromium numberOfPatients: 3 maxAppointments: 2 service_name: General Medicine service	An appointment service should not allow a new appointment after going past the max number	FAIL	6.4 Recorded Errors assert successful == maxAppointments, (f"{successful} successful appointments of {numberOfPatients} appointment attempts of a max {maxAppointments} appointments.") AssertionError: 3 successful appointments of 3 appointment attempts of a max 2 appointments. assert 3 == 2	MEDIUM	39.06s
Appointments should be blocked after reaching max load	browser_name: chromium numberOfPatients: 3 maxAppointments: 2 service_name: Outpatient Department	An appointment service should not allow a new appointment after going past the max number	FAIL	6.4 Recorded Errors assert successful == maxAppointments, (f"{successful} successful appointments of {numberOfPatients} appointment attempts of a max {maxAppointments} appointments.") AssertionError: 3 successful appointments of 3 appointment attempts of a max 2 appointments. assert 3 == 2	MEDIUM	34.95s
Appointments should be blocked after reaching max load	browser_name: chromium numberOfPatients: 3 maxAppointments: 2 service_name: Rehabilitation service	An appointment service should not allow a new appointment after going past the max number	FAIL	6.4 Recorded Errors assert successful == maxAppointments, (f"{successful} successful appointments of {numberOfPatients} appointment attempts of a max {maxAppointments} appointments.") AssertionError: 3 successful appointments of 3 appointment attempts of a max 2 appointments. assert 3 == 2	MEDIUM	34.76s

Test Name ▼

Parameters ▼

Description ▼

Status ▼

CVSS Score (Baseline) ▼

Severity ▼

Duration ▼

Appointments should be blocked after reaching max load

browser_name: chromium

numberOfPatients: 3

maxAppointments: 2

service_name: General Medicine service

An appointment service should not allow a new appointment after going past the max number

FAIL

MEDIUM

39.06s

Appointments should be blocked after reaching max load

browser_name: chromium

numberOfPatients: 3

maxAppointments: 2

service_name: Outpatient Department

An appointment service should not allow a new appointment after going past the max number

FAIL

MEDIUM

34.95s

Appointments should be blocked after reaching max load

browser_name: chromium

numberOfPatients: 3

maxAppointments: 2

service_name: Rehabilitation service

An appointment service should not allow a new appointment after going past the max number

FAIL

MEDIUM

34.76s

Passed Tests 3 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Appointments should be blocked after reaching max load	browser_name: chromium numberOfPatients: 2 maxAppointments: 2 service_name: General Medicine service	An appointment service should not allow a new appointment after going past the max number	PASS	6.4	MEDIUM	24.16s
Appointments should be blocked after reaching max load	browser_name: chromium numberOfPatients: 2 maxAppointments: 2 service_name: Outpatient Department	An appointment service should not allow a new appointment after going past the max number	PASS	6.4	MEDIUM	23.95s
Appointments should be blocked after reaching max load	browser_name: chromium numberOfPatients: 2 maxAppointments: 2 service_name: Rehabilitation service	An appointment service should not allow a new appointment after going past the max number	PASS	6.4	MEDIUM	24.02s

Test Name ▼

Parameters ▼

Description ▼

Status ▼

CVSS Score (Baseline) ▼

Severity ▼

Duration ▼

Appointments should be blocked after reaching max load

browser_name: chromium

numberOfPatients: 2

maxAppointments: 2

service_name: General Medicine service

An appointment service should not allow a new appointment after going past the max number

PASS

6.4

MEDIUM

24.16s

Appointments should be blocked after reaching max load

browser_name: chromium

numberOfPatients: 2

maxAppointments: 2

service_name: Outpatient Department

An appointment service should not allow a new appointment after going past the max number

PASS

6.4

MEDIUM

23.95s

Appointments should be blocked after reaching max load

browser_name: chromium

numberOfPatients: 2

maxAppointments: 2

service_name: Rehabilitation service

An appointment service should not allow a new appointment after going past the max number

PASS

6.4

MEDIUM

24.02s

⚠️ Session Management Highest CVSS: 9.2 — CRITICAL Max CVSS trend: 0.0 -

4 passed / 2 failed · 6 tests ▼

Failed Tests 2 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Session cookie should change when logging out	N/A	After a user logs out of a system, the cookie holding information about the login should expire and a new one should be created	FAIL	9.2 Recorded Errors assert new_cookie["value"] != old_cookie["value"] AssertionError: assert '329E79D676EC731E5DEB4FD9C87B951E' != '329E79D676EC731E5DEB4FD9C87B951E'	CRITICAL	4.47s
Cookies have Secure attribute	N/A	Test whether cookies have the secure attribute enabled.	FAIL	9.2 Recorded Errors assert cookie["secure"] == True assert False == True	CRITICAL	2.37s

Passed Tests 4 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Cookies have HTTPOnly attribute	N/A	Test whether cookies have the HTTPOnly attribute enabled.	PASS	9.2	CRITICAL	2.38s
Session cookie hijacked	N/A	After a user logs out of a system, the cookie holding information about the login is used to try and regain access	PASS	9.2	CRITICAL	4.56s
Cookies have SameSite attribute	N/A	Test whether cookies have the SameSite attribute to Strict or Lax.	PASS	5.1	MEDIUM	2.4s
Session cookie can be used by a valid user	N/A	After leaving the page and coming back without logging out the cookie information grants access to the users account	PASS	9.2	CRITICAL	3.04s

❌ Data Integrity Failures Highest CVSS: 8.6 — HIGH Max CVSS trend: 0.0 -

0 passed / 1 failed · 1 tests ▼

Failed Tests 1 test

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Replace session cookies with another's session	browser_name: chromium	If a session token can be replaced with another, a compromised session token at one location could give an attacker unrestricted access at another	FAIL	8.6 Recorded Errors expect(page.get_by_text("Super User"), message="Another account, other than Admin, was logged in to").to_have_count(1) AssertionError: Another account, other than Admin, was logged in to Expected value: '1' Actual value: 0 Call log: - Expect "to_have_count" with timeout 5000ms - waiting for get_by_text("Super User") 9 × locator resolved to 0 elements - unexpected value "0"	HIGH	10.36s

❌ Mishandling of Exceptional Conditions Highest CVSS: 6.4 — MEDIUM Max CVSS trend: 0.0 -

0 passed / 1 failed · 1 tests ▼

Failed Tests 1 test

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Web server version name and number should not be shown on 404 page	N/A	Apache Tomcat version number should not be shown when the default HTTP 404 Error page is shown	FAIL	6.4 Recorded Errors assert page_data["is_text_on_page"] == False assert True == False	MEDIUM	1.07s

✅ Access Control Max CVSS trend: 0.0 -

8 passed / 0 failed · 8 tests ▼

Passed Tests 8 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Users cannot edit the admin account password	nonAdminType: clerk	Non Admin users should not be able to edit the password of the admin account by posting to the API.	PASS	8.6	HIGH	0.17s
Users cannot edit the admin account password	nonAdminType: technician	Non Admin users should not be able to edit the password of the admin account by posting to the API.	PASS	8.6	HIGH	0.03s
Users cannot edit the admin account password	nonAdminType: nurse	Non Admin users should not be able to edit the password of the admin account by posting to the API.	PASS	8.6	HIGH	0.02s
Users cannot edit the admin account password	nonAdminType: doctor	Non Admin users should not be able to edit the password of the admin account by posting to the API.	PASS	8.6	HIGH	0.02s
Users can edit their own passwords	nonAdminType: clerk	Non Admin users should be able to edit their passwords	PASS	7.7	HIGH	0.08s
Users can edit their own passwords	nonAdminType: technician	Non Admin users should be able to edit their passwords	PASS	7.7	HIGH	0.05s
Users can edit their own passwords	nonAdminType: nurse	Non Admin users should be able to edit their passwords	PASS	7.7	HIGH	0.04s
Users can edit their own passwords	nonAdminType: doctor	Non Admin users should be able to edit their passwords	PASS	7.7	HIGH	0.05s

✅ Authentication Max CVSS trend: 0.0 -

42 passed / 0 failed · 42 tests ▼

Passed Tests 42 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Brute force attack on login page causes lockout	username: admin password: Admin123 cleanup_clear_user_lockout: doctor	Tests whether the system will lockout an attacker from a brute force attack.	PASS	9.2	CRITICAL	20.06s
Brute force attack on login page causes lockout	username: doctor password: Doctor123 cleanup_clear_user_lockout: doctor	Tests whether the system will lockout an attacker from a brute force attack.	PASS	9.2	CRITICAL	19.59s
Brute force attack on login page causes lockout	username: nurse password: Nurse123 cleanup_clear_user_lockout: doctor	Tests whether the system will lockout an attacker from a brute force attack.	PASS	9.2	CRITICAL	19.59s
Brute force attack on login page causes lockout	username: clerk password: Clerk123 cleanup_clear_user_lockout: doctor	Tests whether the system will lockout an attacker from a brute force attack.	PASS	9.2	CRITICAL	19.61s
Brute force attack on login page causes lockout	username: technician password: Technician123 cleanup_clear_user_lockout: doctor	Tests whether the system will lockout an attacker from a brute force attack.	PASS	9.2	CRITICAL	19.6s
Brute force attack on REST API causes lockout	username: admin password: Admin123	Tests whether the system will lockout an attacker from a brute force attack.	PASS	9.2	CRITICAL	0.06s
Brute force attack on REST API causes lockout	username: doctor password: Doctor123	Tests whether the system will lockout an attacker from a brute force attack.	PASS	9.2	CRITICAL	0.06s
Brute force attack on REST API causes lockout	username: nurse password: Nurse123	Tests whether the system will lockout an attacker from a brute force attack.	PASS	9.2	CRITICAL	0.05s
Brute force attack on REST API causes lockout	username: clerk password: Clerk123	Tests whether the system will lockout an attacker from a brute force attack.	PASS	9.2	CRITICAL	0.05s
Brute force attack on REST API causes lockout	username: technician password: Technician123	Tests whether the system will lockout an attacker from a brute force attack.	PASS	9.2	CRITICAL	0.05s
Brute force password attack via REST API with known admin username	cleanup_clear_user_lockout: admin	Tests whether an attacker can login accross the API using a known username and random passwords.	PASS	10.0	CRITICAL	0.04s
Brute force password attack with known admin username	cleanup_clear_user_lockout: admin	Tests whether an attacker can login to the login page using a known username and random passwords.	PASS	10.0	CRITICAL	21.51s
Correct credentials allows login on REST API	username: admin password: Admin123	Tests whether a regular user can log in to the api	PASS	9.0	CRITICAL	0.02s
Correct credentials allows login on REST API	username: doctor password: Doctor123	Tests whether a regular user can log in to the api	PASS	9.0	CRITICAL	0.02s
Correct credentials allows login on REST API	username: nurse password: Nurse123	Tests whether a regular user can log in to the api	PASS	9.0	CRITICAL	0.02s
Correct credentials allows login on REST API	username: clerk password: Clerk123	Tests whether a regular user can log in to the api	PASS	9.0	CRITICAL	0.01s
Correct credentials allows login on REST API	username: technician password: Technician123	Tests whether a regular user can log in to the api	PASS	9.0	CRITICAL	0.01s
Correct credentials allows login on login page	username: admin password: Admin123	Tests whether a regular user can log in to the webpage	PASS	9.0	CRITICAL	3.45s
Correct credentials allows login on login page	username: doctor password: Doctor123	Tests whether a regular user can log in to the webpage	PASS	9.0	CRITICAL	3.39s
Correct credentials allows login on login page	username: nurse password: Nurse123	Tests whether a regular user can log in to the webpage	PASS	9.0	CRITICAL	3.46s
Correct credentials allows login on login page	username: clerk password: Clerk123	Tests whether a regular user can log in to the webpage	PASS	9.0	CRITICAL	3.43s
Correct credentials allows login on login page	username: technician password: Technician123	Tests whether a regular user can log in to the webpage	PASS	9.0	CRITICAL	3.43s
Lockout on login page is accessible after 5 minutes	username: admin password: Admin123	Tests whether an account is accessible after a 5 minute waiting period	PASS	9.0	CRITICAL	21.71s
Lockout on login page is accessible after 5 minutes	username: doctor password: Doctor123	Tests whether an account is accessible after a 5 minute waiting period	PASS	9.0	CRITICAL	21.71s
Lockout on login page is accessible after 5 minutes	username: nurse password: Nurse123	Tests whether an account is accessible after a 5 minute waiting period	PASS	9.0	CRITICAL	21.71s
Lockout on login page is accessible after 5 minutes	username: clerk password: Clerk123	Tests whether an account is accessible after a 5 minute waiting period	PASS	9.0	CRITICAL	21.71s
Lockout on login page is accessible after 5 minutes	username: technician password: Technician123	Tests whether an account is accessible after a 5 minute waiting period	PASS	9.0	CRITICAL	21.69s
Lockout on login page is not accessible at 4 minutes and 50 seconds	username: admin password: Admin123	Tests whether an account is accessible after a 4 minute and 50 second waiting period	PASS	9.2	CRITICAL	23.66s
Lockout on login page is not accessible at 4 minutes and 50 seconds	username: doctor password: Doctor123	Tests whether an account is accessible after a 4 minute and 50 second waiting period	PASS	9.2	CRITICAL	23.65s
Lockout on login page is not accessible at 4 minutes and 50 seconds	username: nurse password: Nurse123	Tests whether an account is accessible after a 4 minute and 50 second waiting period	PASS	9.2	CRITICAL	23.69s
Lockout on login page is not accessible at 4 minutes and 50 seconds	username: clerk password: Clerk123	Tests whether an account is accessible after a 4 minute and 50 second waiting period	PASS	9.2	CRITICAL	23.65s
Lockout on login page is not accessible at 4 minutes and 50 seconds	username: technician password: Technician123	Tests whether an account is accessible after a 4 minute and 50 second waiting period	PASS	9.2	CRITICAL	23.72s
Lockout on REST API is accessible after 5 minutes	username: admin password: Admin123	Tests whether an account is accessible after a 5 minute waiting period	PASS	9.0	CRITICAL	0.07s
Lockout on REST API is accessible after 5 minutes	username: doctor password: Doctor123	Tests whether an account is accessible after a 5 minute waiting period	PASS	9.0	CRITICAL	0.06s
Lockout on REST API is accessible after 5 minutes	username: nurse password: Nurse123	Tests whether an account is accessible after a 5 minute waiting period	PASS	9.0	CRITICAL	0.06s
Lockout on REST API is accessible after 5 minutes	username: clerk password: Clerk123	Tests whether an account is accessible after a 5 minute waiting period	PASS	9.0	CRITICAL	0.06s
Lockout on REST API is accessible after 5 minutes	username: technician password: Technician123	Tests whether an account is accessible after a 5 minute waiting period	PASS	9.0	CRITICAL	0.05s
Lockout on REST API is not accessible at 4 minutes and 50 seconds	username: admin password: Admin123	Tests whether an account is accessible after a 4 minute and 50 second waiting period	PASS	9.2	CRITICAL	0.07s
Lockout on REST API is not accessible at 4 minutes and 50 seconds	username: doctor password: Doctor123	Tests whether an account is accessible after a 4 minute and 50 second waiting period	PASS	9.2	CRITICAL	0.05s
Lockout on REST API is not accessible at 4 minutes and 50 seconds	username: nurse password: Nurse123	Tests whether an account is accessible after a 4 minute and 50 second waiting period	PASS	9.2	CRITICAL	0.05s
Lockout on REST API is not accessible at 4 minutes and 50 seconds	username: clerk password: Clerk123	Tests whether an account is accessible after a 4 minute and 50 second waiting period	PASS	9.2	CRITICAL	0.05s
Lockout on REST API is not accessible at 4 minutes and 50 seconds	username: technician password: Technician123	Tests whether an account is accessible after a 4 minute and 50 second waiting period	PASS	9.2	CRITICAL	0.05s

✅ Cryptographic Failures Max CVSS trend: 0.0 -

2 passed / 0 failed · 2 tests ▼

Passed Tests 2 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
The OpenMRS application should not use the default encryption key	N/A	The current encrpytion key should not match the default key for the system.	PASS	10.0	CRITICAL	0.01s
The OpenMRS application should not use the default encryption vector	N/A	The current encrpytion vector should not match the default vector for the system.	PASS	10.0	CRITICAL	0.01s

✅ SQL Injection Max CVSS trend: 0.0 -

3 passed / 0 failed · 3 tests ▼

Passed Tests 3 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
SQL injection on first name field of edit patient page	browser_name: chromium personNameSQLString: first name testString: hello;CREATE TABLE testingTable (testfield datetime PRIMARY KEY);	A parameterized test to try several potential SQL injection strings that target the person_name table of the OpenMRS O3 data model.	PASS	9.2	CRITICAL	20.65s
SQL injection on middle name field of edit patient page	browser_name: chromium personNameSQLString: middle name testString: hello;CREATE TABLE testingTable (testfield datetime PRIMARY KEY);	A parameterized test to try several potential SQL injection strings that target the person_name table of the OpenMRS O3 data model.	PASS	9.2	CRITICAL	13.94s
SQL injection on family name field of edit patient page	browser_name: chromium personNameSQLString: family name testString: hello;CREATE TABLE testingTable (testfield datetime PRIMARY KEY);	A parameterized test to try several potential SQL injection strings that target the person_name table of the OpenMRS O3 data model.	PASS	9.2	CRITICAL	13.96s

Test Name ▼

Parameters ▼

Description ▼

Status ▼

CVSS Score (Baseline) ▼

Severity ▼

Duration ▼

SQL injection on first name field of edit patient page

browser_name: chromium

personNameSQLString: first name

testString: hello;CREATE TABLE testingTable (testfield datetime PRIMARY KEY);

A parameterized test to try several potential SQL injection strings that target the person_name table of the OpenMRS O3 data model.

PASS

9.2

CRITICAL

20.65s

SQL injection on middle name field of edit patient page

browser_name: chromium

personNameSQLString: middle name

testString: hello;CREATE TABLE testingTable (testfield datetime PRIMARY KEY);

A parameterized test to try several potential SQL injection strings that target the person_name table of the OpenMRS O3 data model.

PASS

9.2

CRITICAL

13.94s

SQL injection on family name field of edit patient page

browser_name: chromium

personNameSQLString: family name

testString: hello;CREATE TABLE testingTable (testfield datetime PRIMARY KEY);

A parameterized test to try several potential SQL injection strings that target the person_name table of the OpenMRS O3 data model.

PASS

9.2

CRITICAL

13.96s

✅ Security Logging & Alerting Failures Max CVSS trend: 0.0 -

12 passed / 0 failed · 12 tests ▼

Passed Tests 12 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Server logs should not show failed login attempts with correct credentials	username: admin password: Admin123	A login attempt with a correct username and password should be not shown as a failed login attempt in the server logs	PASS	6.4	MEDIUM	7.98s
Server logs should not show failed login attempts with correct credentials	username: doctor password: Doctor123	A login attempt with a correct username and password should be not shown as a failed login attempt in the server logs	PASS	6.4	MEDIUM	8.77s
Server logs should not show failed login attempts with correct credentials	username: nurse password: Nurse123	A login attempt with a correct username and password should be not shown as a failed login attempt in the server logs	PASS	6.4	MEDIUM	8.74s
Server logs should not show failed login attempts with correct credentials	username: clerk password: Clerk123	A login attempt with a correct username and password should be not shown as a failed login attempt in the server logs	PASS	6.4	MEDIUM	8.73s
Server logs should not show failed login attempts with correct credentials	username: technician password: Technician123	A login attempt with a correct username and password should be not shown as a failed login attempt in the server logs	PASS	6.4	MEDIUM	8.7s
Server logs should show failed login attempts	username: admin	A failed login attempt with an incorrect username or password should be shown in the logs	PASS	6.4	MEDIUM	5.64s
Server logs should show failed login attempts	username: doctor	A failed login attempt with an incorrect username or password should be shown in the logs	PASS	6.4	MEDIUM	5.61s
Server logs should show failed login attempts	username: nurse	A failed login attempt with an incorrect username or password should be shown in the logs	PASS	6.4	MEDIUM	5.71s
Server logs should show failed login attempts	username: clerk	A failed login attempt with an incorrect username or password should be shown in the logs	PASS	6.4	MEDIUM	5.7s
Server logs should show failed login attempts	username: technician	A failed login attempt with an incorrect username or password should be shown in the logs	PASS	6.4	MEDIUM	5.63s
Server logs should show failed login attempts	username: fakeusername1	A failed login attempt with an incorrect username or password should be shown in the logs	PASS	6.4	MEDIUM	5.62s
Server logs should show failed login attempts	username: fakeusername2	A failed login attempt with an incorrect username or password should be shown in the logs	PASS	6.4	MEDIUM	5.65s

✅ XSS Max CVSS trend: 0.0 -

40 passed / 0 failed · 40 tests ▼

Passed Tests 40 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Valid input for first name field of edit patient page is not blocked by filters	browser_name: chromium scenarioString: first name	A parameterized test to try valid input on the to ensure they aren't block by XSS filters/.	PASS	8.6	HIGH	7.82s
XSS injection on first name field of edit patient page, parameterized	browser_name: chromium scenarioString: first name testString: <img src/onerror=prompt('XSS')	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.99s
Valid input for middle name field of edit patient page is not blocked by filters	browser_name: chromium scenarioString: middle name	A parameterized test to try valid input on the to ensure they aren't block by XSS filters/.	PASS	8.6	HIGH	7.66s
XSS injection on first name field of edit patient page, parameterized	browser_name: chromium scenarioString: first name testString: <img src=x onerror=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.92s
Valid input for family name field of edit patient page is not blocked by filters	browser_name: chromium scenarioString: family name	A parameterized test to try valid input on the to ensure they aren't block by XSS filters/.	PASS	8.6	HIGH	7.7s
XSS injection on first name field of edit patient page, parameterized	browser_name: chromium scenarioString: first name testString: <svg onload=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.02s
Valid input for address 1 field of edit patient page is not blocked by filters	browser_name: chromium scenarioString: address 1	A parameterized test to try valid input on the to ensure they aren't block by XSS filters/.	PASS	8.6	HIGH	7.68s
XSS injection on middle name field of edit patient page, parameterized	browser_name: chromium scenarioString: middle name testString: <img src/onerror=prompt('XSS')	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.78s
Valid input for address 2 field of edit patient page is not blocked by filters	browser_name: chromium scenarioString: address 2	A parameterized test to try valid input on the to ensure they aren't block by XSS filters/.	PASS	8.6	HIGH	7.77s
XSS injection on middle name field of edit patient page, parameterized	browser_name: chromium scenarioString: middle name testString: <img src=x onerror=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.92s
Valid input for city field of edit patient page is not blocked by filters	browser_name: chromium scenarioString: city	A parameterized test to try valid input on the to ensure they aren't block by XSS filters/.	PASS	8.6	HIGH	7.81s
XSS injection on middle name field of edit patient page, parameterized	browser_name: chromium scenarioString: middle name testString: <svg onload=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.88s
Valid input for state field of edit patient page is not blocked by filters	browser_name: chromium scenarioString: state	A parameterized test to try valid input on the to ensure they aren't block by XSS filters/.	PASS	8.6	HIGH	7.79s
XSS injection on family name field of edit patient page, parameterized	browser_name: chromium scenarioString: family name testString: <img src/onerror=prompt('XSS')	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.09s
Valid input for country field of edit patient page is not blocked by filters	browser_name: chromium scenarioString: country	A parameterized test to try valid input on the to ensure they aren't block by XSS filters/.	PASS	8.6	HIGH	7.76s
XSS injection on family name field of edit patient page, parameterized	browser_name: chromium scenarioString: family name testString: <img src=x onerror=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.88s
Valid input for postal code field of edit patient page is not blocked by filters	browser_name: chromium scenarioString: postal code	A parameterized test to try valid input on the to ensure they aren't block by XSS filters/.	PASS	8.6	HIGH	7.71s
XSS injection on family name field of edit patient page, parameterized	browser_name: chromium scenarioString: family name testString: <svg onload=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.95s
Valid input for phone number field of edit patient page is not blocked by filters	browser_name: chromium scenarioString: phone number	A parameterized test to try valid input on the to ensure they aren't block by XSS filters/.	PASS	8.6	HIGH	7.68s
XSS injection on address 1 field of edit patient page, parameterized	browser_name: chromium scenarioString: address 1 testString: <img src/onerror=prompt('XSS')	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.82s
XSS injection on address 1 field of edit patient page, parameterized	browser_name: chromium scenarioString: address 1 testString: <img src=x onerror=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.84s
XSS injection on address 1 field of edit patient page, parameterized	browser_name: chromium scenarioString: address 1 testString: <svg onload=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.84s
XSS injection on address 2 field of edit patient page, parameterized	browser_name: chromium scenarioString: address 2 testString: <img src/onerror=prompt('XSS')	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.87s
XSS injection on address 2 field of edit patient page, parameterized	browser_name: chromium scenarioString: address 2 testString: <img src=x onerror=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.84s
XSS injection on address 2 field of edit patient page, parameterized	browser_name: chromium scenarioString: address 2 testString: <svg onload=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.81s
XSS injection on city field of edit patient page, parameterized	browser_name: chromium scenarioString: city testString: <img src/onerror=prompt('XSS')	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.95s
XSS injection on city field of edit patient page, parameterized	browser_name: chromium scenarioString: city testString: <img src=x onerror=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.93s
XSS injection on city field of edit patient page, parameterized	browser_name: chromium scenarioString: city testString: <svg onload=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.91s
XSS injection on state field of edit patient page, parameterized	browser_name: chromium scenarioString: state testString: <img src/onerror=prompt('XSS')	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.04s
XSS injection on state field of edit patient page, parameterized	browser_name: chromium scenarioString: state testString: <img src=x onerror=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.0s
XSS injection on state field of edit patient page, parameterized	browser_name: chromium scenarioString: state testString: <svg onload=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.87s
XSS injection on country field of edit patient page, parameterized	browser_name: chromium scenarioString: country testString: <img src/onerror=prompt('XSS')	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.92s
XSS injection on country field of edit patient page, parameterized	browser_name: chromium scenarioString: country testString: <img src=x onerror=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.01s
XSS injection on country field of edit patient page, parameterized	browser_name: chromium scenarioString: country testString: <svg onload=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.86s
XSS injection on postal code field of edit patient page, parameterized	browser_name: chromium scenarioString: postal code testString: <img src/onerror=prompt('XSS')	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.01s
XSS injection on postal code field of edit patient page, parameterized	browser_name: chromium scenarioString: postal code testString: <img src=x onerror=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.9s
XSS injection on postal code field of edit patient page, parameterized	browser_name: chromium scenarioString: postal code testString: <svg onload=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.86s
XSS injection on phone number field of edit patient page, parameterized	browser_name: chromium scenarioString: phone number testString: <img src/onerror=prompt('XSS')	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.87s
XSS injection on phone number field of edit patient page, parameterized	browser_name: chromium scenarioString: phone number testString: <img src=x onerror=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.82s
XSS injection on phone number field of edit patient page, parameterized	browser_name: chromium scenarioString: phone number testString: <svg onload=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	9.94s

🔒 OpenMRS O3 Security Dashboard

Total Tests

Passed

Failed

Duration

Failed Tests by Category

Test Coverage