Threats tagged 'ghsa-x7rh-2f5c-xx9f'

OpenEMR versions prior to 8.3.0 have a missing authorization vulnerability in the library/ajax/upload.php component. This flaw allows any authenticated user, including low-privilege users, to read and overwrite document data by specifying arbitrary document IDs. Exploitation enables enumeration of document IDs and unauthorized access to patient health information, as well as tampering with medical records across all patients.