CVE-2021-32101
First published: Fri May 07 2021(Updated: )
The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php. To exploit the vulnerability, an unauthenticated attacker can register an account, bypassing the permission check of this portal's API. Then, the attacker can then manipulate and read data of every registered patient.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Open-emr Openemr | =5.0.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability
- https://community.open-emr.org/t/openemr-5-0-2-patch-5-has-been-released/15431
- https://community.sonarsource.com/t/openemr-5-0-2-1-command-injection-vulnerability-puts-health-records-at-risk/33592
- https://portswigger.net/daily-swig/healthcare-security-openemr-fixes-serious-flaws-that-lead-to-command-execution-in-patient-portal
Frequently Asked Questions
What is the severity of CVE-2021-32101?
The severity of CVE-2021-32101 is high with a severity score of 8.2.
How is the Patient Portal of OpenEMR 5.0.2.1 affected?
The Patient Portal of OpenEMR 5.0.2.1 is affected by an incorrect access control system in portal/patient/_machine_config.php.
How can an attacker exploit CVE-2021-32101?
An unauthenticated attacker can register an account and bypass the permission check of the Patient Portal's API to manipulate data.
What is the affected software for CVE-2021-32101?
The affected software for CVE-2021-32101 is OpenEMR 5.0.2.1.
Are there any references for CVE-2021-32101?
Yes, there are references available at: [Reference 1](https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability), [Reference 2](https://community.open-emr.org/t/openemr-5-0-2-patch-5-has-been-released/15431), [Reference 3](https://community.sonarsource.com/t/openemr-5-0-2-1-command-injection-vulnerability-puts-health-records-at-risk/33592).
- collector/nvd-index
- agent/type
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/description
- agent/event
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/open-emr
- canonical/open-emr openemr
- version/open-emr openemr/5.0.2.1