OpenEMR missing write access check allows unauthorized document reassignment
A basic user account in this medical records app can move other patients' documents!
Summary
Before OpenEMR 8.4.0, any logged-in low-privilege user can reassign an arbitrary document to a patient or category they can access. Clinics and anyone running OpenEMR before 8.4.0 are affected.
Affected when
- A low-privilege logged-in account
- OpenEMR before 8.4.0
What to do
Update to OpenEMR 8.4.0.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
Times
First published
First seen