OpenMRS version 2.3 (1.11.4) suffers from an expression language injection vulnerability that can lead to arbitrary java code being executed.