Threats tagged 'ghsa-hmxh-v4q7-5wcq'

OpenEMR versions before 8.3.0 have a missing authorization vulnerability in the interface/billing/sl_eob_patient_note.php component. This flaw allows any authenticated user, including those with low privileges, to read and modify patient billing notes by exploiting the patient_id parameter and submitting POST requests with a valid CSRF token. The vulnerability exposes confidential billing data to unauthorized access and tampering.