Threats tagged 'ghsa-xfhv-f3c4-7vww'

OpenEMR versions prior to 8.5.0 have a missing authorization vulnerability in the print_referral.php and trend_form.php scripts. This flaw allows low-privileged Front Office users to access patient protected health information (PHI) without the required patients:med permission. Attackers can exploit this by sending requests with arbitrary patient_id values to retrieve sensitive patient demographics, insurance information, and vitals history, potentially enumerating patient IDs to increase data disclosure.