CVE-2021-32101

Katalog CVE

CVSS 8.2 · High EPSS 1,2%

Kerentanan Incorrect Permission Assignment for Critical Resource pada open-emr openemr. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php. To exploit the vulnerability, an unauthenticated attacker can register an account, bypassing the permission check of this portal's API. Then, the attacker can then manipulate and read data of every registered patient.

Rincian

Terbit di NVD

7 Mei 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://community.open-emr.org/t/openemr-5-0-2-patch-5-has-been-released/15431 advisory vendor
• https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability advisory pihak ketiga
• https://community.sonarsource.com/t/openemr-5-0-2-1-command-injection-vulnerability-puts-health-records-at-ris... advisory pihak ketiga
• https://portswigger.net/daily-swig/healthcare-security-openemr-fixes-serious-flaws-that-lead-to-command-execut... advisory pihak ketiga