CVE-2023-54347: OpenEMR 7.0.1 Authentication Brute Force Mitigation Bypass
OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts to the main login endpoint. Attackers can submit POST requests with authUser and clearPass parameters to systematically test username and password combinations without account lockout restrictions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-54347?
CVE-2023-54347 is classified as a high-severity vulnerability due to its potential to allow unauthorized access through brute force attacks.
How do I fix CVE-2023-54347?
To mitigate CVE-2023-54347, it's recommended to implement additional security measures such as account lockout policies or CAPTCHA mechanisms.
What version of OpenEMR is affected by CVE-2023-54347?
CVE-2023-54347 affects OpenEMR version 7.0.1.
What type of attack does CVE-2023-54347 allow?
CVE-2023-54347 allows attackers to perform brute force authentication attacks without being limited by rate limiting protections.
Are there any known exploits for CVE-2023-54347?
Yes, there are known exploit methods that take advantage of this vulnerability by bypassing the authentication protections.