CVE-2021-25923: High severity openemr vulnerability
In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit. If a malicious user is aware of the first 72 characters of the victim user’s password, he can leverage it to an account takeover.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-25923?
CVE-2021-25923 is a vulnerability in OpenEMR versions 5.0.0 to 6.0.0.1 that allows for weak password requirements and can lead to an account takeover.
How does CVE-2021-25923 work?
CVE-2021-25923 allows a malicious user who knows the first 72 characters of a victim user's password to leverage it for an account takeover.
What is the severity of CVE-2021-25923?
CVE-2021-25923 has a severity rating of 8.1 (high).
Which software versions are affected by CVE-2021-25923?
OpenEMR versions 5.0.0 to 6.0.0.1 are affected by CVE-2021-25923.
Is there a fix for CVE-2021-25923?
There is no specific fix mentioned, but it is recommended to enforce a maximum password length limit to mitigate this vulnerability.