#VU31233 Improper Authentication in OpenEMR - CVE-2018-15152

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU31233

#VU31233 Improper Authentication in OpenEMR - CVE-2018-15152

Published: August 15, 2018 / Updated: June 17, 2021


Vulnerability identifier: #VU31233
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/U:Amber
CVE-ID: CVE-2018-15152
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability: Public exploit is available
Vulnerable software:
OpenEMR
Software vendor:
OpenEMR

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access (1) portal/add_edit_event_user.php, (2) portal/find_appt_popup_user.php, (3) portal/get_allergies.php, (4) portal/get_amendments.php, (5) portal/get_lab_results.php, (6) portal/get_medications.php, (7) portal/get_patient_documents.php, (8) portal/get_problems.php, (9) portal/get_profile.php, (10) portal/portal_payment.php, (11) portal/messaging/messages.php, (12) portal/messaging/secure_chat.php, (13) portal/report/pat_ledger.php, (14) portal/report/portal_custom_report.php, or (15) portal/report/portal_patient_report.php without authenticating as a patient.


Remediation

Install update from vendor's website.

External links