Threats tagged 'ghsa-m7wh-83wm-x2gq'

OpenEMR versions prior to 8.3.0 have missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module. These vulnerabilities allow authenticated low-privilege users to access and modify other patients' records. Specifically, attackers can view sensitive patient information such as names, medical record numbers (MRNs), insurance, and prior authorization data by requesting certain endpoints, and can overwrite other patients' prior-authorization records by submitting arbitrary IDs.