OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved…
OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved system-level FHIR access. Attackers can register a colon-form system:Patient.read client that bypasses approval, then request unregistered system/Patient.write scope to read, modify, and create Patient records.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Openemr
- Product
- openemr
- CVSS v3.1
- 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weakness
- CWE-863
- Exposure class
- OT / ICS
- NVD status
- Awaiting Analysis
Why it ranks 38 (Notable)
- CVSS v3.1 9.1 critical
- Product class: OT / ICS
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.