Threats tagged 'ghsa-pj2w-4q83-hqcg'

OpenEMR versions prior to 8.3.0 have a missing authorization vulnerability in the billing interface (sl_eob_invoice.php) that allows any authenticated user to read and modify billing data for any patient encounter. This includes reading patient names and billing notes and posting payments, adjustments, deletions, or billing notes to any patient's account.