PT-2025-22810 · Openemr · Openemr

Nazmul-Me · Published 2025-05-23 · Updated 2025-07-02 · CVE-2025-32967

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 7.0.3.4

Description A logging oversight in OpenEMR allows password change events to go unrecorded on the client-side log viewer. This prevents administrators from auditing critical actions, weakening traceability and opening the system to undetectable misuse by insiders or attackers.

Recommendations For versions prior to 7.0.3.4, update to version 7.0.3.4 to resolve the issue. As a temporary workaround, consider closely monitoring system activity and user actions to detect potential misuse until the update can be applied. Restrict access to sensitive areas of the application to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-778

Related Identifiers

CVE-2025-32967

GHSA-7QJ6-JXFC-XW4V

Affected Products

Openemr

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32967.json · Exploit
• https://github.com/openemr/openemr/security/advisories/GHSA-7qj6-jxfc-xw4v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32967 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32967 · Security Note
• https://t.me/cvenotify/127331 · Telegram Post
• https://twitter.com/dailycve/status/1940233520796115443 · Twitter Post
• https://twitter.com/CVEnew/status/1926244428663988254 · Twitter Post
• https://t.me/cvetracker/24552 · Telegram Post