Threats tagged 'ghsa-6frr-mhqw-hcvv'

OpenEMR versions prior to 8.3.0 have an insecure direct object reference (IDOR) vulnerability in portal/lib/persist.php. This flaw allows authenticated portal patients to modify other patients' settings by supplying arbitrary setting_patient values. Exploitation can lead to unauthorized insertion or overwriting of patient_settings entries, potentially suppressing notifications, tampering with consent flags, or altering portal preferences.