CVE-2018-10572

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 5.0.1

Description: The issue allows remote authenticated users to bypass intended access restrictions. This is achieved via the newtemplatename and form body parameters in the interface/patient file/letter.php file.

Recommendations: For versions prior to 5.0.1, update to version 5.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the interface/patient file/letter.php file until the update is applied. Avoid using the newtemplatename and form body parameters in the affected file until the issue is resolved.