Accounting User Can Download Patient Reports in openemr in GitHub repository openemr/openemr prior to 6.1.0.
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
| Link | Tags |
|---|---|
| https://huntr.dev/bounties/0bb2979b-9643-4cdf-ab58-4354976b481b | exploit third party advisory patch |
| https://github.com/openemr/openemr/commit/a2e918abcf15f9fc1f7cb4a1f2b09ff019021175 | third party advisory patch |