Insufficient Session Expiration in OpenEMR - #VU158845

Vulnerability details

The vulnerability allows an attacker with physical access to system to access protected health information and perform actions through an unattended user's session after the configured idle timeout should have expired.

The vulnerability exists due to insufficient session expiration in OpenEMR's session handling when the Eye Exam form is open in read-only mode. Background polling every 15 seconds omits skip_timeout_reset, causing library/auth.inc.php to reset the idle timer despite the absence of user activity. An attacker with physical access to system can use an unattended workstation left on this view to access protected health information and act through the user's still-active session.

Affected software

Remediation

External References

• https://github.com/openemr/openemr/security/advisories/GHSA-fc6f-f47r-j9x8

Related Security Bulletins

• Multiple vulnerabilities in OpenEMR