PT-2021-3416 · Openemr · Openemr

Dennis Brinkrolf + 1 · Published 2021-05-07 · Updated 2021-05-11 · CVE-2021-32101

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR version 5.0.2.1

Description The issue is related to insufficient permission assignment checks for a critical resource in the portal/patient/ machine config.php component of OpenEMR. This can allow a remote attacker to gain unauthorized access to protected information. An unauthenticated attacker can exploit this by registering an account and bypassing the permission check of the portal's API, then manipulating and reading data of every registered patient.

Recommendations For OpenEMR version 5.0.2.1, consider restricting access to the portal/patient/ machine config.php component until a patch is available. As a temporary workaround, limit the registration of new accounts and closely monitor API activity to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2021-03268

CVE-2021-32101

Affected Products

Openemr

References · 7

• https://bdu.fstec.ru/vul/2021-03268 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-32101 · Security Note
• https://community.open-emr.org/t/openemr-5-0-2-patch-5-has-been-released/15431 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32101 · Vendor Advisory
• https://community.sonarsource.com/t/openemr-5-0-2-1-command-injection-vulnerability-puts-health-records-at-risk/33592 · Note
• https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability · Note
• https://portswigger.net/daily-swig/healthcare-security-openemr-fixes-serious-flaws-that-lead-to-command-execution-in-patient-portal · Note