PT-2021-16850 · Openemr · Openemr

Published 2021-03-22 · Updated 2022-07-12 · CVE-2021-25920

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions v2.7.2-rc1 through 6.0.0

Description The issue concerns Improper Access Control when creating a new user. This allows a malicious user to read and send sensitive messages on behalf of the victim user.

Recommendations For OpenEMR versions v2.7.2-rc1 through 6.0.0, consider restricting access to user creation functionality until a patch is available. As a temporary workaround, limit the privileges of newly created users to prevent them from reading or sending sensitive messages. Additionally, monitor user activity closely for any signs of unauthorized access or message sending. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-178

Related Identifiers

CVE-2021-25920

Affected Products

Openemr

References · 7

• https://github.com/openemr/openemr/commit/0fadc3e592d84bc9dfe9e0403f8bd6e3c7d8427f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-25920 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25920 · Vendor Advisory
• https://t.me/cibsecurity/25263 · Telegram Post
• https://t.me/cvenotify/11881 · Telegram Post
• https://t.me/cvenotify/11721 · Telegram Post
• https://whitesourcesoftware.com/vulnerability-database/CVE-2021-25920 · Note