Threats tagged 'ghsa-cgq4-xj72-ccv4'

OpenEMR versions prior to 8.3.0 have an insecure direct object reference (IDOR) vulnerability in the PortalPatientController::Read() function. This flaw allows authenticated patients to access pending demographic change requests of other patients by manipulating the patientId query parameter. Sensitive personal health information (PHI) such as names, addresses, Social Security numbers, and insurance details can be exposed through this vulnerability.