PT-2022-13693 · Openemr · Openemr

Published 2022-03-30 · Updated 2022-04-04 · CVE-2022-1177

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions openemr versions prior to 6.1.0

Description The issue allows an accounting user to download patient reports in openemr. This is a problem because accounting users should not have access to patient reports.

Recommendations For versions prior to 6.1.0, update to version 6.1.0 or later to resolve the issue.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-1220

Related Identifiers

CVE-2022-1177

Affected Products

Openemr

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1177.json · Exploit
• 🔥 https://huntr.dev/bounties/0bb2979b-9643-4cdf-ab58-4354976b481b · Exploit
• https://github.com/openemr/openemr/commit/a2e918abcf15f9fc1f7cb4a1f2b09ff019021175 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-1177 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1177 · Vendor Advisory
• https://t.me/cibsecurity/39800 · Telegram Post