CVE-2015-4453interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts,…
Updated under an hour ago ()
Does this affect you?
It affects open-emr openemr. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 2.85%, higher than 87% of scored CVEs.
Do this next
Free account, 1 product
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts, as demonstrated by (1) interface/fax/fax_dispatch_newpid.php and (2) interface/billing/sl_eob_search.php.
- CVSS
- 5.0 MEDIUM (v2.0, NVD)AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 2.85% (percentile 87)
- Assigned by
- mitre
- NVD analysis
- Modified
- Record last updated
- Aug 6, 2024
- First seen by InfoSec Signals
- Oct 12, 2026
Affected products
open-emr openemr open-emr:openemr | 2.8.3; 2.9.0; 3.0.1; 3.1.0; 3.2.0; 4.0.0; 4.1.0; 4.1.1; and 2 more ranges | NVD |
References
- http://seclists.org/fulldisclosure/2015/Jun/48mailing-list, x-refsource-fulldisc
- http://jvndb.jvn.jp/jvndb/JVNDB-2015-000092third-party-advisory, x-refsource-jvndb, vendor-advisory
- http://packetstormsecurity.com/files/132368/OpenEMR-4.2.0-Authentication-Bypass.htmlx-refsource-misc
- http://jvn.jp/en/jp/JVN22677713/index.htmlthird-party-advisory, x-refsource-jvn, vendor-advisory
- http://www.open-emr.org/wiki/index.php/OpenEMR_Patchesx-refsource-misc, patch, vendor-advisory
- http://www.securityfocus.com/bid/75299vdb-entry, x-refsource-bid
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.