OpenEMR is the world’s most popular open source electronic health records and medical practice management solution, and is used globally to manage millions of patient records.
We recently discovered several security vulnerabilities within Version 5.0.1(6) with potentially severe implications. While these issues have been resolved in Version 5.0.2, the wide distribution of earlier versions plus the impact of successful exploitation requires us to publish the details of our discoveries.
Identified vulnerabilities include remote code execution (CVE-2019-8371) and several instances of cross-site scripting (CVE-2019-8368). Successful exploitation of the identified vulnerabilities could lead to server compromise and allow an administrative attacker to execute code on the underlying server. In all situations, sensitive patient information would be at risk.
After closely working with the vendor, we are releasing the details in accordance with our Responsible Disclosure Policy. You can find more information and specific technical information by reading the OpenEMR Advisory.
As of this writing, OpenEMR has announced no plans to issue further patches for Version 5.0.1. While unconfirmed, we also highly suspect these vulnerabilities exist in earlier releases. Users are strongly urged to upgrade to Version 5.0.2, which rectifies these issues.
For more information, please refer to OpenEMR.
Subscribe to Bishop Fox's Security Blog
Be first to learn about latest tools, advisories, and findings.
Thank You! You have been subscribed.
You might be interested in these related posts.
Sep 19, 2023
Financial Services: 2023 Insights From the Ponemon Institute
Sep 05, 2023
The Dark Side of Convenience: Understanding the Dangers of Digital Supply Chain
Aug 23, 2023
A Bishop Fox Recap - Hacker Summer Camp 2023
Jul 18, 2023
Cloud Offensive Security: 2023 Insights From the Ponemon Institute