CVE-2021-32101: High severity openemr vulnerability
The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/machineconfig.php. To exploit the vulnerability, an unauthenticated attacker can register an account, bypassing the permission check of this portal's API. Then, the attacker can then manipulate and read data of every registered patient.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-32101?
The severity of CVE-2021-32101 is high with a severity score of 8.2.
How is the Patient Portal of OpenEMR 5.0.2.1 affected?
The Patient Portal of OpenEMR 5.0.2.1 is affected by an incorrect access control system in portal/patient/_machine_config.php.
How can an attacker exploit CVE-2021-32101?
An unauthenticated attacker can register an account and bypass the permission check of the Patient Portal's API to manipulate data.
What is the affected software for CVE-2021-32101?
The affected software for CVE-2021-32101 is OpenEMR 5.0.2.1.
Are there any references for CVE-2021-32101?
Yes, there are references available at: [Reference 1](https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability), [Reference 2](https://community.open-emr.org/t/openemr-5-0-2-patch-5-has-been-released/15431), [Reference 3](https://community.sonarsource.com/t/openemr-5-0-2-1-command-injection-vulnerability-puts-health-records-at-risk/33592).