OpenMRS O3 Security Dashboard

⚠️ Memory Management Failures Highest CVSS: 10.0 — CRITICAL Max CVSS trend: 0.0 -

12 passed / 8 failed · 20 tests ▼

Failed Tests 8 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Integer overflow of quantity on billing page	browser_name: chromium quantity: 2147483648 billing_category: Antenatal care	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	FAIL	10.0 Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 2147483648 has wrapped around to -2147483648 assert -2147483648 == 2147483648	CRITICAL	20.9s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 2147483648 billing_category: Orthopedic Service	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	FAIL	10.0 Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 2147483648 has wrapped around to -2147483648 assert -2147483648 == 2147483648	CRITICAL	20.9s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 2147483648 billing_category: Nutrition counseling	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	FAIL	10.0 Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 2147483648 has wrapped around to -2147483648 assert -2147483648 == 2147483648	CRITICAL	20.9s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 2147483648 billing_category: OPD consultation	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	FAIL	10.0 Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 2147483648 has wrapped around to -2147483648 assert -2147483648 == 2147483648	CRITICAL	20.85s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 4294967294 billing_category: Antenatal care	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	FAIL	10.0 Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 4294967294 has wrapped around to -2 assert -2 == 4294967294	CRITICAL	20.84s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 4294967294 billing_category: Orthopedic Service	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	FAIL	10.0 Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 4294967294 has wrapped around to -2 assert -2 == 4294967294	CRITICAL	20.9s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 4294967294 billing_category: Nutrition counseling	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	FAIL	10.0 Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 4294967294 has wrapped around to -2 assert -2 == 4294967294	CRITICAL	20.87s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 4294967294 billing_category: OPD consultation	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	FAIL	10.0 Recorded Errors assert quantity_value == quantity, f"Original quantity {quantity} has wrapped around to {quantity_value}" AssertionError: Original quantity 4294967294 has wrapped around to -2 assert -2 == 4294967294	CRITICAL	20.88s

Passed Tests 12 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Integer overflow of quantity on billing page	browser_name: chromium quantity: 1 billing_category: Antenatal care	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	21.97s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 1 billing_category: Orthopedic Service	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.88s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 1 billing_category: Nutrition counseling	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.88s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 1 billing_category: OPD consultation	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.88s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 1000000 billing_category: Antenatal care	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.88s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 1000000 billing_category: Orthopedic Service	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.92s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 1000000 billing_category: Nutrition counseling	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.88s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 1000000 billing_category: OPD consultation	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.9s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 2147483647 billing_category: Antenatal care	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.88s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 2147483647 billing_category: Orthopedic Service	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.91s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 2147483647 billing_category: Nutrition counseling	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.9s
Integer overflow of quantity on billing page	browser_name: chromium quantity: 2147483647 billing_category: OPD consultation	On the quantity field of the billing page, a large integer should not cause an integer overflow or wraparound	PASS	10.0	CRITICAL	20.87s

⚠️ Security Misconfiguration Highest CVSS: 8.2 — HIGH Max CVSS trend: 0.0 -

28 passed / 4 failed · 32 tests ▼

Failed Tests 4 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Security header attribute 'unsafe-eval' should not be used for default-src directive on login page	attribute: 'unsafe-eval'	The content-security-policy header should not have unsafe- attributes for the default-src directive	FAIL	8.2 Recorded Errors assert attribute not in security_policy_dict["default-src"] assert "'unsafe-eval'" not in ["'self'", "'unsafe-inline'", "'unsafe-eval'", 'localhost', 'localhost:*']	HIGH	0.27s
Security header attribute 'unsafe-inline' should not be used for default-src directive on login page	attribute: 'unsafe-inline'	The content-security-policy header should not have unsafe- attributes for the default-src directive	FAIL	8.2 Recorded Errors assert attribute not in security_policy_dict["default-src"] assert "'unsafe-inline'" not in ["'self'", "'unsafe-inline'", "'unsafe-eval'", 'localhost', 'localhost:*']	HIGH	0.44s
Security header directive form-action should be set to 'none' or 'self' on login page	directive: form-action fallback: False	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	FAIL	8.2 Recorded Errors assert is_directive_secure == True assert False == True	HIGH	0.27s
*Security header directive form-action should not be set to or http: on login page**	directive: form-action fallback: False	Directives should not be set to * or http: on login page if it exists and falls back to default-src	FAIL	8.2 Recorded Errors assert is_directive_secure == True assert False == True	HIGH	0.26s

Passed Tests 28 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Security header attribute 'unsafe-hash' should not be used for default-src directive on login page	attribute: 'unsafe-hash'	The content-security-policy header should not have unsafe- attributes for the default-src directive	PASS	8.2	HIGH	0.26s
Security header directive default-src should be set to 'none' or 'self' on login page	directive: default-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.26s
Security header directive script-src should be set to 'none' or 'self' on login page	directive: script-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.26s
Security header directive style-src should be set to 'none' or 'self' on login page	directive: style-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.26s
Security header directive connect-src should be set to 'none' or 'self' on login page	directive: connect-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.26s
Security header directive media-src should be set to 'none' or 'self' on login page	directive: media-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.26s
Security header directive object-src should be set to 'none' or 'self' on login page	directive: object-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.27s
Security header directive frame-src should be set to 'none' or 'self' on login page	directive: frame-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.27s
Security header directive worker-src should be set to 'none' or 'self' on login page	directive: worker-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.26s
Security header directive manifest-src should be set to 'none' or 'self' on login page	directive: manifest-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.26s
Security header directive child-src should be set to 'none' or 'self' on login page	directive: child-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.26s
Security header directive font-src should be set to 'none' or 'self' on login page	directive: font-src fallback: True	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.27s
Security header directive frame-ancestors should be set to 'none' or 'self' on login page	directive: frame-ancestors fallback: False	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.26s
Security header directive base-uri should be set to 'none' or 'self' on login page	directive: base-uri fallback: False	Directives should be set to 'none' or 'self' on login page if it exists and does not fall back to default-src	PASS	8.2	HIGH	0.26s
*Security header directive default-src should not be set to or http: on login page**	directive: default-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.26s
*Security header directive script-src should not be set to or http: on login page**	directive: script-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.27s
*Security header directive style-src should not be set to or http: on login page**	directive: style-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.27s
*Security header directive connect-src should not be set to or http: on login page**	directive: connect-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.26s
*Security header directive media-src should not be set to or http: on login page**	directive: media-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.26s
*Security header directive object-src should not be set to or http: on login page**	directive: object-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.26s
*Security header directive frame-src should not be set to or http: on login page**	directive: frame-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.27s
*Security header directive worker-src should not be set to or http: on login page**	directive: worker-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.26s
*Security header directive manifest-src should not be set to or http: on login page**	directive: manifest-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.26s
*Security header directive child-src should not be set to or http: on login page**	directive: child-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.26s
*Security header directive font-src should not be set to or http: on login page**	directive: font-src fallback: True	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.26s
*Security header directive frame-ancestors should not be set to or http: on login page**	directive: frame-ancestors fallback: False	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.27s
*Security header directive base-uri should not be set to or http: on login page**	directive: base-uri fallback: False	Directives should not be set to * or http: on login page if it exists and falls back to default-src	PASS	8.2	HIGH	0.26s
Security header x-content-type-options is set to nosniff on login page	N/A	Files are run using the content type because nosniff is set for the header x-content-type-options	PASS	4.8	MEDIUM	0.26s

⚠️ Insecure Design Highest CVSS: 6.4 — MEDIUM Max CVSS trend: 0.0 -

3 passed / 3 failed · 6 tests ▼

Failed Tests 3 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Appointments should be blocked after reaching max load	browser_name: chromium numberOfPatients: 3 maxAppointments: 2 service_name: General Medicine service	An appointment service should not allow a new appointment after going past the max number	FAIL	6.4 Recorded Errors assert successful == maxAppointments, (f"{successful} successful appointments of {numberOfPatients} appointment attempts of a max {maxAppointments} appointments.") AssertionError: 3 successful appointments of 3 appointment attempts of a max 2 appointments. assert 3 == 2	MEDIUM	42.1s
Appointments should be blocked after reaching max load	browser_name: chromium numberOfPatients: 3 maxAppointments: 2 service_name: Outpatient Department	An appointment service should not allow a new appointment after going past the max number	FAIL	6.4 Recorded Errors assert successful == maxAppointments, (f"{successful} successful appointments of {numberOfPatients} appointment attempts of a max {maxAppointments} appointments.") AssertionError: 3 successful appointments of 3 appointment attempts of a max 2 appointments. assert 3 == 2	MEDIUM	36.13s
Appointments should be blocked after reaching max load	browser_name: chromium numberOfPatients: 3 maxAppointments: 2 service_name: Rehabilitation service	An appointment service should not allow a new appointment after going past the max number	FAIL	6.4 Recorded Errors assert successful == maxAppointments, (f"{successful} successful appointments of {numberOfPatients} appointment attempts of a max {maxAppointments} appointments.") AssertionError: 3 successful appointments of 3 appointment attempts of a max 2 appointments. assert 3 == 2	MEDIUM	36.02s

Test Name ▼

Parameters ▼

Description ▼

Status ▼

CVSS Score (Baseline) ▼

Severity ▼

Duration ▼

Appointments should be blocked after reaching max load

browser_name: chromium

numberOfPatients: 3

maxAppointments: 2

service_name: General Medicine service

An appointment service should not allow a new appointment after going past the max number

FAIL

MEDIUM

42.1s

Appointments should be blocked after reaching max load

browser_name: chromium

numberOfPatients: 3

maxAppointments: 2

service_name: Outpatient Department

An appointment service should not allow a new appointment after going past the max number

FAIL

MEDIUM

36.13s

Appointments should be blocked after reaching max load

browser_name: chromium

numberOfPatients: 3

maxAppointments: 2

service_name: Rehabilitation service

An appointment service should not allow a new appointment after going past the max number

FAIL

MEDIUM

36.02s

Passed Tests 3 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Appointments should be blocked after reaching max load	browser_name: chromium numberOfPatients: 2 maxAppointments: 2 service_name: General Medicine service	An appointment service should not allow a new appointment after going past the max number	PASS	6.4	MEDIUM	24.95s
Appointments should be blocked after reaching max load	browser_name: chromium numberOfPatients: 2 maxAppointments: 2 service_name: Outpatient Department	An appointment service should not allow a new appointment after going past the max number	PASS	6.4	MEDIUM	24.92s
Appointments should be blocked after reaching max load	browser_name: chromium numberOfPatients: 2 maxAppointments: 2 service_name: Rehabilitation service	An appointment service should not allow a new appointment after going past the max number	PASS	6.4	MEDIUM	24.9s

Test Name ▼

Parameters ▼

Description ▼

Status ▼

CVSS Score (Baseline) ▼

Severity ▼

Duration ▼

Appointments should be blocked after reaching max load

browser_name: chromium

numberOfPatients: 2

maxAppointments: 2

service_name: General Medicine service

An appointment service should not allow a new appointment after going past the max number

PASS

6.4

MEDIUM

24.95s

Appointments should be blocked after reaching max load

browser_name: chromium

numberOfPatients: 2

maxAppointments: 2

service_name: Outpatient Department

An appointment service should not allow a new appointment after going past the max number

PASS

6.4

MEDIUM

24.92s

Appointments should be blocked after reaching max load

browser_name: chromium

numberOfPatients: 2

maxAppointments: 2

service_name: Rehabilitation service

An appointment service should not allow a new appointment after going past the max number

PASS

6.4

MEDIUM

24.9s

❌ Data Integrity Failures Highest CVSS: 8.6 — HIGH Max CVSS trend: 0.0 -

0 passed / 1 failed · 1 tests ▼

Failed Tests 1 test

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Replace session cookies with another's session	browser_name: chromium	If a session token can be replaced with another, a compromised session token at one location could give an attacker unrestricted access at another	FAIL	8.6 Recorded Errors expect(page.get_by_text("Super User"), message="Another account, other than Admin, was logged in to").to_have_count(1) AssertionError: Another account, other than Admin, was logged in to Expected value: '1' Actual value: 0 Call log: - Expect "to_have_count" with timeout 5000ms - waiting for get_by_text("Super User") 9 × locator resolved to 0 elements - unexpected value "0"	HIGH	10.93s

❌ Mishandling of Exceptional Conditions Highest CVSS: 6.4 — MEDIUM Max CVSS trend: 0.0 -

0 passed / 1 failed · 1 tests ▼

Failed Tests 1 test

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Web server version name and number should not be shown on 404 page	N/A	Apache Tomcat version number should not be shown when the default HTTP 404 Error page is shown	FAIL	6.4 Recorded Errors assert page_data["is_text_on_page"] == False assert True == False	MEDIUM	1.08s

⚠️ Session Management Highest CVSS: 9.2 — CRITICAL Max CVSS trend: 0.0 -

5 passed / 1 failed · 6 tests ▼

Failed Tests 1 test

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Cookies have Secure attribute	N/A	Test whether cookies have the secure attribute enabled.	FAIL	9.2 Recorded Errors assert cookie["secure"] == True assert False == True	CRITICAL	2.5s

Passed Tests 5 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Session cookie should change when logging out	N/A	After a user logs out of a system, the cookie holding information about the login should expire and a new one should be created	PASS	9.2	CRITICAL	4.76s
Cookies have HTTPOnly attribute	N/A	Test whether cookies have the HTTPOnly attribute enabled.	PASS	9.2	CRITICAL	2.52s
Session cookie hijacked	N/A	After a user logs out of a system, the cookie holding information about the login is used to try and regain access	PASS	9.2	CRITICAL	4.75s
Cookies have SameSite attribute	N/A	Test whether cookies have the SameSite attribute to Strict or Lax.	PASS	5.1	MEDIUM	2.51s
Session cookie can be used by a valid user	N/A	After leaving the page and coming back without logging out the cookie information grants access to the users account	PASS	9.2	CRITICAL	3.22s

✅ Access Control Max CVSS trend: 0.0 -

8 passed / 0 failed · 8 tests ▼

Passed Tests 8 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Users cannot edit the admin account password	nonAdminType: clerk	Non Admin users should not be able to edit the password of the admin account by posting to the API.	PASS	8.6	HIGH	0.23s
Users cannot edit the admin account password	nonAdminType: technician	Non Admin users should not be able to edit the password of the admin account by posting to the API.	PASS	8.6	HIGH	0.05s
Users cannot edit the admin account password	nonAdminType: nurse	Non Admin users should not be able to edit the password of the admin account by posting to the API.	PASS	8.6	HIGH	0.04s
Users cannot edit the admin account password	nonAdminType: doctor	Non Admin users should not be able to edit the password of the admin account by posting to the API.	PASS	8.6	HIGH	0.04s
Users can edit their own passwords	nonAdminType: clerk	Non Admin users should be able to edit their passwords	PASS	7.7	HIGH	0.09s
Users can edit their own passwords	nonAdminType: technician	Non Admin users should be able to edit their passwords	PASS	7.7	HIGH	0.07s
Users can edit their own passwords	nonAdminType: nurse	Non Admin users should be able to edit their passwords	PASS	7.7	HIGH	0.08s
Users can edit their own passwords	nonAdminType: doctor	Non Admin users should be able to edit their passwords	PASS	7.7	HIGH	0.06s

✅ Authentication Max CVSS trend: 0.0 -

42 passed / 0 failed · 42 tests ▼

Passed Tests 42 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Brute force attack on login page causes lockout	username: admin password: Admin123 cleanup_clear_user_lockout: doctor	Tests whether the system will lockout an attacker from a brute force attack.	PASS	9.2	CRITICAL	20.48s
Brute force attack on login page causes lockout	username: doctor password: Doctor123 cleanup_clear_user_lockout: doctor	Tests whether the system will lockout an attacker from a brute force attack.	PASS	9.2	CRITICAL	19.87s
Brute force attack on login page causes lockout	username: nurse password: Nurse123 cleanup_clear_user_lockout: doctor	Tests whether the system will lockout an attacker from a brute force attack.	PASS	9.2	CRITICAL	19.86s
Brute force attack on login page causes lockout	username: clerk password: Clerk123 cleanup_clear_user_lockout: doctor	Tests whether the system will lockout an attacker from a brute force attack.	PASS	9.2	CRITICAL	19.86s
Brute force attack on login page causes lockout	username: technician password: Technician123 cleanup_clear_user_lockout: doctor	Tests whether the system will lockout an attacker from a brute force attack.	PASS	9.2	CRITICAL	19.87s
Brute force attack on REST API causes lockout	username: admin password: Admin123	Tests whether the system will lockout an attacker from a brute force attack.	PASS	9.2	CRITICAL	0.1s
Brute force attack on REST API causes lockout	username: doctor password: Doctor123	Tests whether the system will lockout an attacker from a brute force attack.	PASS	9.2	CRITICAL	0.11s
Brute force attack on REST API causes lockout	username: nurse password: Nurse123	Tests whether the system will lockout an attacker from a brute force attack.	PASS	9.2	CRITICAL	0.09s
Brute force attack on REST API causes lockout	username: clerk password: Clerk123	Tests whether the system will lockout an attacker from a brute force attack.	PASS	9.2	CRITICAL	0.08s
Brute force attack on REST API causes lockout	username: technician password: Technician123	Tests whether the system will lockout an attacker from a brute force attack.	PASS	9.2	CRITICAL	0.09s
Brute force password attack via REST API with known admin username	cleanup_clear_user_lockout: admin	Tests whether an attacker can login accross the API using a known username and random passwords.	PASS	10.0	CRITICAL	0.07s
Brute force password attack with known admin username	cleanup_clear_user_lockout: admin	Tests whether an attacker can login to the login page using a known username and random passwords.	PASS	10.0	CRITICAL	21.77s
Correct credentials allows login on REST API	username: admin password: Admin123	Tests whether a regular user can log in to the api	PASS	9.0	CRITICAL	0.02s
Correct credentials allows login on REST API	username: doctor password: Doctor123	Tests whether a regular user can log in to the api	PASS	9.0	CRITICAL	0.04s
Correct credentials allows login on REST API	username: nurse password: Nurse123	Tests whether a regular user can log in to the api	PASS	9.0	CRITICAL	0.03s
Correct credentials allows login on REST API	username: clerk password: Clerk123	Tests whether a regular user can log in to the api	PASS	9.0	CRITICAL	0.02s
Correct credentials allows login on REST API	username: technician password: Technician123	Tests whether a regular user can log in to the api	PASS	9.0	CRITICAL	0.02s
Correct credentials allows login on login page	username: admin password: Admin123	Tests whether a regular user can log in to the webpage	PASS	9.0	CRITICAL	3.65s
Correct credentials allows login on login page	username: doctor password: Doctor123	Tests whether a regular user can log in to the webpage	PASS	9.0	CRITICAL	3.64s
Correct credentials allows login on login page	username: nurse password: Nurse123	Tests whether a regular user can log in to the webpage	PASS	9.0	CRITICAL	3.7s
Correct credentials allows login on login page	username: clerk password: Clerk123	Tests whether a regular user can log in to the webpage	PASS	9.0	CRITICAL	3.67s
Correct credentials allows login on login page	username: technician password: Technician123	Tests whether a regular user can log in to the webpage	PASS	9.0	CRITICAL	3.63s
Lockout on login page is accessible after 5 minutes	username: admin password: Admin123	Tests whether an account is accessible after a 5 minute waiting period	PASS	9.0	CRITICAL	22.06s
Lockout on login page is accessible after 5 minutes	username: doctor password: Doctor123	Tests whether an account is accessible after a 5 minute waiting period	PASS	9.0	CRITICAL	22.03s
Lockout on login page is accessible after 5 minutes	username: nurse password: Nurse123	Tests whether an account is accessible after a 5 minute waiting period	PASS	9.0	CRITICAL	22.03s
Lockout on login page is accessible after 5 minutes	username: clerk password: Clerk123	Tests whether an account is accessible after a 5 minute waiting period	PASS	9.0	CRITICAL	22.01s
Lockout on login page is accessible after 5 minutes	username: technician password: Technician123	Tests whether an account is accessible after a 5 minute waiting period	PASS	9.0	CRITICAL	21.99s
Lockout on login page is not accessible at 4 minutes and 50 seconds	username: admin password: Admin123	Tests whether an account is accessible after a 4 minute and 50 second waiting period	PASS	9.2	CRITICAL	23.92s
Lockout on login page is not accessible at 4 minutes and 50 seconds	username: doctor password: Doctor123	Tests whether an account is accessible after a 4 minute and 50 second waiting period	PASS	9.2	CRITICAL	23.95s
Lockout on login page is not accessible at 4 minutes and 50 seconds	username: nurse password: Nurse123	Tests whether an account is accessible after a 4 minute and 50 second waiting period	PASS	9.2	CRITICAL	23.94s
Lockout on login page is not accessible at 4 minutes and 50 seconds	username: clerk password: Clerk123	Tests whether an account is accessible after a 4 minute and 50 second waiting period	PASS	9.2	CRITICAL	23.97s
Lockout on login page is not accessible at 4 minutes and 50 seconds	username: technician password: Technician123	Tests whether an account is accessible after a 4 minute and 50 second waiting period	PASS	9.2	CRITICAL	23.95s
Lockout on REST API is accessible after 5 minutes	username: admin password: Admin123	Tests whether an account is accessible after a 5 minute waiting period	PASS	9.0	CRITICAL	0.09s
Lockout on REST API is accessible after 5 minutes	username: doctor password: Doctor123	Tests whether an account is accessible after a 5 minute waiting period	PASS	9.0	CRITICAL	0.09s
Lockout on REST API is accessible after 5 minutes	username: nurse password: Nurse123	Tests whether an account is accessible after a 5 minute waiting period	PASS	9.0	CRITICAL	0.09s
Lockout on REST API is accessible after 5 minutes	username: clerk password: Clerk123	Tests whether an account is accessible after a 5 minute waiting period	PASS	9.0	CRITICAL	0.1s
Lockout on REST API is accessible after 5 minutes	username: technician password: Technician123	Tests whether an account is accessible after a 5 minute waiting period	PASS	9.0	CRITICAL	0.09s
Lockout on REST API is not accessible at 4 minutes and 50 seconds	username: admin password: Admin123	Tests whether an account is accessible after a 4 minute and 50 second waiting period	PASS	9.2	CRITICAL	0.08s
Lockout on REST API is not accessible at 4 minutes and 50 seconds	username: doctor password: Doctor123	Tests whether an account is accessible after a 4 minute and 50 second waiting period	PASS	9.2	CRITICAL	0.07s
Lockout on REST API is not accessible at 4 minutes and 50 seconds	username: nurse password: Nurse123	Tests whether an account is accessible after a 4 minute and 50 second waiting period	PASS	9.2	CRITICAL	0.07s
Lockout on REST API is not accessible at 4 minutes and 50 seconds	username: clerk password: Clerk123	Tests whether an account is accessible after a 4 minute and 50 second waiting period	PASS	9.2	CRITICAL	0.07s
Lockout on REST API is not accessible at 4 minutes and 50 seconds	username: technician password: Technician123	Tests whether an account is accessible after a 4 minute and 50 second waiting period	PASS	9.2	CRITICAL	0.08s

✅ Cryptographic Failures Max CVSS trend: 0.0 -

2 passed / 0 failed · 2 tests ▼

Passed Tests 2 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
The OpenMRS application should not use the default encryption key	N/A	The current encrpytion key should not match the default key for the system.	PASS	10.0	CRITICAL	0.01s
The OpenMRS application should not use the default encryption vector	N/A	The current encrpytion vector should not match the default vector for the system.	PASS	10.0	CRITICAL	0.01s

✅ SQL Injection Max CVSS trend: 0.0 -

3 passed / 0 failed · 3 tests ▼

Passed Tests 3 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
SQL injection on first name field of edit patient page	browser_name: chromium personNameSQLString: first name testString: hello;CREATE TABLE testingTable (testfield datetime PRIMARY KEY);	A parameterized test to try several potential SQL injection strings that target the person_name table of the OpenMRS O3 data model.	PASS	9.2	CRITICAL	22.05s
SQL injection on middle name field of edit patient page	browser_name: chromium personNameSQLString: middle name testString: hello;CREATE TABLE testingTable (testfield datetime PRIMARY KEY);	A parameterized test to try several potential SQL injection strings that target the person_name table of the OpenMRS O3 data model.	PASS	9.2	CRITICAL	14.61s
SQL injection on family name field of edit patient page	browser_name: chromium personNameSQLString: family name testString: hello;CREATE TABLE testingTable (testfield datetime PRIMARY KEY);	A parameterized test to try several potential SQL injection strings that target the person_name table of the OpenMRS O3 data model.	PASS	9.2	CRITICAL	14.6s

Test Name ▼

Parameters ▼

Description ▼

Status ▼

CVSS Score (Baseline) ▼

Severity ▼

Duration ▼

SQL injection on first name field of edit patient page

browser_name: chromium

personNameSQLString: first name

testString: hello;CREATE TABLE testingTable (testfield datetime PRIMARY KEY);

A parameterized test to try several potential SQL injection strings that target the person_name table of the OpenMRS O3 data model.

PASS

9.2

CRITICAL

22.05s

SQL injection on middle name field of edit patient page

browser_name: chromium

personNameSQLString: middle name

testString: hello;CREATE TABLE testingTable (testfield datetime PRIMARY KEY);

A parameterized test to try several potential SQL injection strings that target the person_name table of the OpenMRS O3 data model.

PASS

9.2

CRITICAL

14.61s

SQL injection on family name field of edit patient page

browser_name: chromium

personNameSQLString: family name

testString: hello;CREATE TABLE testingTable (testfield datetime PRIMARY KEY);

A parameterized test to try several potential SQL injection strings that target the person_name table of the OpenMRS O3 data model.

PASS

9.2

CRITICAL

14.6s

✅ Security Logging & Alerting Failures Max CVSS trend: 0.0 -

12 passed / 0 failed · 12 tests ▼

Passed Tests 12 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Server logs should not show failed login attempts with correct credentials	username: admin password: Admin123	A login attempt with a correct username and password should be not shown as a failed login attempt in the server logs	PASS	6.4	MEDIUM	8.77s
Server logs should not show failed login attempts with correct credentials	username: doctor password: Doctor123	A login attempt with a correct username and password should be not shown as a failed login attempt in the server logs	PASS	6.4	MEDIUM	8.94s
Server logs should not show failed login attempts with correct credentials	username: nurse password: Nurse123	A login attempt with a correct username and password should be not shown as a failed login attempt in the server logs	PASS	6.4	MEDIUM	8.97s
Server logs should not show failed login attempts with correct credentials	username: clerk password: Clerk123	A login attempt with a correct username and password should be not shown as a failed login attempt in the server logs	PASS	6.4	MEDIUM	8.94s
Server logs should not show failed login attempts with correct credentials	username: technician password: Technician123	A login attempt with a correct username and password should be not shown as a failed login attempt in the server logs	PASS	6.4	MEDIUM	8.94s
Server logs should show failed login attempts	username: admin	A failed login attempt with an incorrect username or password should be shown in the logs	PASS	6.4	MEDIUM	5.84s
Server logs should show failed login attempts	username: doctor	A failed login attempt with an incorrect username or password should be shown in the logs	PASS	6.4	MEDIUM	5.94s
Server logs should show failed login attempts	username: nurse	A failed login attempt with an incorrect username or password should be shown in the logs	PASS	6.4	MEDIUM	5.93s
Server logs should show failed login attempts	username: clerk	A failed login attempt with an incorrect username or password should be shown in the logs	PASS	6.4	MEDIUM	5.94s
Server logs should show failed login attempts	username: technician	A failed login attempt with an incorrect username or password should be shown in the logs	PASS	6.4	MEDIUM	5.95s
Server logs should show failed login attempts	username: fakeusername1	A failed login attempt with an incorrect username or password should be shown in the logs	PASS	6.4	MEDIUM	5.95s
Server logs should show failed login attempts	username: fakeusername2	A failed login attempt with an incorrect username or password should be shown in the logs	PASS	6.4	MEDIUM	5.84s

✅ XSS Max CVSS trend: 0.0 -

40 passed / 0 failed · 40 tests ▼

Passed Tests 40 tests

Test Name ▼	Parameters ▼	Description ▼	Status ▼	CVSS Score (Baseline) ▼	Severity ▼	Duration ▼
Valid input for first name field of edit patient page is not blocked by filters	browser_name: chromium scenarioString: first name	A parameterized test to try valid input on the to ensure they aren't block by XSS filters/.	PASS	8.6	HIGH	8.63s
XSS injection on first name field of edit patient page, parameterized	browser_name: chromium scenarioString: first name testString: <img src/onerror=prompt('XSS')	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	11.25s
Valid input for middle name field of edit patient page is not blocked by filters	browser_name: chromium scenarioString: middle name	A parameterized test to try valid input on the to ensure they aren't block by XSS filters/.	PASS	8.6	HIGH	8.38s
XSS injection on first name field of edit patient page, parameterized	browser_name: chromium scenarioString: first name testString: <img src=x onerror=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.61s
Valid input for family name field of edit patient page is not blocked by filters	browser_name: chromium scenarioString: family name	A parameterized test to try valid input on the to ensure they aren't block by XSS filters/.	PASS	8.6	HIGH	8.37s
XSS injection on first name field of edit patient page, parameterized	browser_name: chromium scenarioString: first name testString: <svg onload=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.7s
Valid input for address 1 field of edit patient page is not blocked by filters	browser_name: chromium scenarioString: address 1	A parameterized test to try valid input on the to ensure they aren't block by XSS filters/.	PASS	8.6	HIGH	8.39s
XSS injection on middle name field of edit patient page, parameterized	browser_name: chromium scenarioString: middle name testString: <img src/onerror=prompt('XSS')	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.65s
Valid input for address 2 field of edit patient page is not blocked by filters	browser_name: chromium scenarioString: address 2	A parameterized test to try valid input on the to ensure they aren't block by XSS filters/.	PASS	8.6	HIGH	8.45s
XSS injection on middle name field of edit patient page, parameterized	browser_name: chromium scenarioString: middle name testString: <img src=x onerror=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.63s
Valid input for city field of edit patient page is not blocked by filters	browser_name: chromium scenarioString: city	A parameterized test to try valid input on the to ensure they aren't block by XSS filters/.	PASS	8.6	HIGH	8.43s
XSS injection on middle name field of edit patient page, parameterized	browser_name: chromium scenarioString: middle name testString: <svg onload=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.65s
Valid input for state field of edit patient page is not blocked by filters	browser_name: chromium scenarioString: state	A parameterized test to try valid input on the to ensure they aren't block by XSS filters/.	PASS	8.6	HIGH	8.49s
XSS injection on family name field of edit patient page, parameterized	browser_name: chromium scenarioString: family name testString: <img src/onerror=prompt('XSS')	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.63s
Valid input for country field of edit patient page is not blocked by filters	browser_name: chromium scenarioString: country	A parameterized test to try valid input on the to ensure they aren't block by XSS filters/.	PASS	8.6	HIGH	8.33s
XSS injection on family name field of edit patient page, parameterized	browser_name: chromium scenarioString: family name testString: <img src=x onerror=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.67s
Valid input for postal code field of edit patient page is not blocked by filters	browser_name: chromium scenarioString: postal code	A parameterized test to try valid input on the to ensure they aren't block by XSS filters/.	PASS	8.6	HIGH	8.37s
XSS injection on family name field of edit patient page, parameterized	browser_name: chromium scenarioString: family name testString: <svg onload=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.62s
Valid input for phone number field of edit patient page is not blocked by filters	browser_name: chromium scenarioString: phone number	A parameterized test to try valid input on the to ensure they aren't block by XSS filters/.	PASS	8.6	HIGH	8.37s
XSS injection on address 1 field of edit patient page, parameterized	browser_name: chromium scenarioString: address 1 testString: <img src/onerror=prompt('XSS')	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.71s
XSS injection on address 1 field of edit patient page, parameterized	browser_name: chromium scenarioString: address 1 testString: <img src=x onerror=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.63s
XSS injection on address 1 field of edit patient page, parameterized	browser_name: chromium scenarioString: address 1 testString: <svg onload=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.63s
XSS injection on address 2 field of edit patient page, parameterized	browser_name: chromium scenarioString: address 2 testString: <img src/onerror=prompt('XSS')	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.63s
XSS injection on address 2 field of edit patient page, parameterized	browser_name: chromium scenarioString: address 2 testString: <img src=x onerror=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.61s
XSS injection on address 2 field of edit patient page, parameterized	browser_name: chromium scenarioString: address 2 testString: <svg onload=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.63s
XSS injection on city field of edit patient page, parameterized	browser_name: chromium scenarioString: city testString: <img src/onerror=prompt('XSS')	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.62s
XSS injection on city field of edit patient page, parameterized	browser_name: chromium scenarioString: city testString: <img src=x onerror=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.61s
XSS injection on city field of edit patient page, parameterized	browser_name: chromium scenarioString: city testString: <svg onload=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.58s
XSS injection on state field of edit patient page, parameterized	browser_name: chromium scenarioString: state testString: <img src/onerror=prompt('XSS')	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	11.1s
XSS injection on state field of edit patient page, parameterized	browser_name: chromium scenarioString: state testString: <img src=x onerror=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	11.09s
XSS injection on state field of edit patient page, parameterized	browser_name: chromium scenarioString: state testString: <svg onload=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.64s
XSS injection on country field of edit patient page, parameterized	browser_name: chromium scenarioString: country testString: <img src/onerror=prompt('XSS')	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.59s
XSS injection on country field of edit patient page, parameterized	browser_name: chromium scenarioString: country testString: <img src=x onerror=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.64s
XSS injection on country field of edit patient page, parameterized	browser_name: chromium scenarioString: country testString: <svg onload=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.62s
XSS injection on postal code field of edit patient page, parameterized	browser_name: chromium scenarioString: postal code testString: <img src/onerror=prompt('XSS')	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	11.04s
XSS injection on postal code field of edit patient page, parameterized	browser_name: chromium scenarioString: postal code testString: <img src=x onerror=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	11.08s
XSS injection on postal code field of edit patient page, parameterized	browser_name: chromium scenarioString: postal code testString: <svg onload=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.59s
XSS injection on phone number field of edit patient page, parameterized	browser_name: chromium scenarioString: phone number testString: <img src/onerror=prompt('XSS')	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.58s
XSS injection on phone number field of edit patient page, parameterized	browser_name: chromium scenarioString: phone number testString: <img src=x onerror=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	11.05s
XSS injection on phone number field of edit patient page, parameterized	browser_name: chromium scenarioString: phone number testString: <svg onload=prompt("XSS")>	A parameterized test to try several potential XSS injection strings on the field of the edit patient page.	PASS	4.4	MEDIUM	10.73s

🔒 OpenMRS O3 Security Dashboard

Total Tests

Passed

Failed

Duration

Failed Tests by Category

Test Coverage