Threats tagged 'ghsa-wwcf-fq8w-6877'

OpenEMR versions prior to 8.5.0 have a missing authorization vulnerability in the ccdaservice/ccda_gateway.php component. This flaw allows any authenticated low-privilege staff user to access other patients' C-CDA documents by exploiting the view or dl actions with sequential patient IDs and their own CSRF token. Sensitive patient information such as medications, problems, allergies, and immunizations can be enumerated and exfiltrated by attackers.