Orta CVSS 6.5
CVE-2026-104135: CVE-2026-104135: eksik yetkilendirme
Açıklama (NVD)
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/payment_ajax.php validates a CSRF token but performs no AclMain authorization check before executing a wildcard search of patient_data. Any authenticated user, including a non-clinical role, can enumerate patient identifiers, full names, and dates of birth through the set_patient branch. This issue is fixed in version 8.3.0.
Özet bilgiler
- CVSS v3.1
- 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - EPSS
- %0,44 (yüzdelik 39)
- CWE
- CWE-862
- Yama
- Yok / bilinmiyor