CVE-2015-4453: Medium severity openemr vulnerability

Published Jul 5, 2015

Updated

interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts, as demonstrated by (1) interface/fax/faxdispatchnewpid.php and (2) interface/billing/sleobsearch.php.

Affected Software

10 affected components

open-emr Openemr=2.8.3

open-emr Openemr=2.9.0

open-emr Openemr=3.0.1

open-emr Openemr=3.1.0

open-emr Openemr=3.2.0

open-emr Openemr=4.0.0

open-emr Openemr=4.1.0

open-emr Openemr=4.1.1

open-emr Openemr=4.1.2

open-emr Openemr=4.2.0

Remediation

Patch Available

http://www.open-emr.org/wiki/index.php/OpenEMR_Patches

Event History

Jul 5, 2015

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4453?

CVE-2015-4453 has a CVSS score indicating a high severity due to its potential for authentication bypass.

How do I fix CVE-2015-4453?

To fix CVE-2015-4453, upgrade OpenEMR to version 4.2.0 patch 2 or a later version as recommended.

Which versions of OpenEMR are affected by CVE-2015-4453?

CVE-2015-4453 affects OpenEMR versions 2.x, 3.x, and 4.x up to but not including 4.2.0 patch 2.

What type of attack does CVE-2015-4453 allow?

CVE-2015-4453 allows remote attackers to bypass authentication to access sensitive information.

What components of OpenEMR are specifically vulnerable in CVE-2015-4453?

CVE-2015-4453 specifically impacts scripts such as interface/fax/fax_dispatch_newpid.php and interface/billing/sl_eob_search.