CVE-2021-32101
HIGHOpenEMR 5.0.2.1 - Unauthenticated Incorrect Permission Assignment for Critical Resource in Patient Portal
Title source: llmDescription
The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php. To exploit the vulnerability, an unauthenticated attacker can register an account, bypassing the permission check of this portal's API. Then, the attacker can then manipulate and read data of every registered patient.
References (4)
Core 4
Core References
Third Party Advisory x_refsource_misc
https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability
Third Party Advisory x_refsource_misc
https://community.sonarsource.com/t/openemr-5-0-2-1-command-injection-vulnerability-puts-health-records-at-risk/33592
Vendor Advisory x_refsource_misc
https://community.open-emr.org/t/openemr-5-0-2-patch-5-has-been-released/15431
Third Party Advisory x_refsource_misc
https://portswigger.net/daily-swig/healthcare-security-openemr-fixes-serious-flaws-that-lead-to-command-execution-in-patient-portal
Scores
CVSS v3
8.2
EPSS
0.0118
EPSS Percentile
63.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Details
CWE
CWE-732
Status
published
Products (1)
open-emr/openemr
5.0.2.1
Published
May 07, 2021
Tracked Since
Feb 18, 2026