PT-2018-12907
CVE-2018-15152
·
تاريخ النشر
2018-08-15
·
تاريخ التحديث
2022-02-10
الوصف من
CVSS 3.1
9.1
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions
OpenEMR versions prior to 5.0.1.4
Description
The issue allows a remote attacker to bypass authentication and access various API endpoints, including "portal/add edit event user.php", "portal/find appt popup user.php", "portal/get allergies.php", "portal/get amendments.php", "portal/get lab results.php", "portal/get medications.php", "portal/get patient documents.php", "portal/get problems.php", "portal/get profile.php", "portal/portal payment.php", "portal/messaging/messages.php", "portal/messaging/secure chat.php", "portal/report/pat ledger.php", "portal/report/portal custom report.php", and "portal/report/portal patient report.php" without authenticating as a patient.
Recommendations
For versions prior to 5.0.1.4, update to version 5.0.1.4 or later to resolve the issue.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾