CVE-2018-15152: Critical severity openemr vulnerability
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access (1) portal/addediteventuser.php, (2) portal/findapptpopupuser.php, (3) portal/getallergies.php, (4) portal/getamendments.php, (5) portal/getlabresults.php, (6) portal/getmedications.php, (7) portal/getpatientdocuments.php, (8) portal/getproblems.php, (9) portal/getprofile.php, (10) portal/portalpayment.php, (11) portal/messaging/messages.php, (12) portal/messaging/securechat.php, (13) portal/report/patledger.php, (14) portal/report/portalcustomreport.php, or (15) portal/report/portalpatientreport.php without authenticating as a patient.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-15152?
The severity of CVE-2018-15152 is classified as critical due to its potential for authentication bypass.
How do I fix CVE-2018-15152?
To fix CVE-2018-15152, upgrade to OpenEMR version 5.0.1.4 or later.
What versions of OpenEMR are affected by CVE-2018-15152?
CVE-2018-15152 affects OpenEMR versions prior to 5.0.1.4.
What type of vulnerability is CVE-2018-15152?
CVE-2018-15152 is an authentication bypass vulnerability.
Can CVE-2018-15152 be exploited remotely?
Yes, CVE-2018-15152 can be exploited remotely by an attacker.