OpenEMR FaxSMS module leaves decrypted patient documents in the webroot
Patient files in a clinic records program can leak onto the internet.
Summary
The OpenEMR FaxSMS module stages decrypted patient documents as plaintext at a web-reachable path and never deletes them. Anyone who obtains or guesses the URL can retrieve patient documents without logging in; versions before 8.2.0 are affected.
Affected when
- oe-module-faxsms module in use
- OpenEMR before 8.2.0
What to do
Update OpenEMR to 8.2.0 or later.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
Times
First published
First seen