OpenEMR is a free and open source electronic health records and medical practice management…

Why it is Yellow

• CVSS 7.5 high
• Remotely exploitable without logging in

References

• https://github.com/openemr/openemr/commit/406bb7015e894c243936b0817d7c7060686a13d9
• https://github.com/openemr/openemr/pull/12766
• https://github.com/openemr/openemr/releases/tag/v8_2_0
• https://github.com/openemr/openemr/security/advisories/GHSA-vv5j-6gjw-ffx9

Original description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.2.0, interface/modules/custom_modules/oe-module-faxsms/src/Controller/SignalWireClient.php decrypts a selected patient document with Document::get_data() and SignalWireClient::uploadFileForFax() writes the plaintext bytes under sites/{siteId}/fax. The module returns the resulting public URL to SignalWire, protects it only with a predictable uniqid() filename, and never removes the staged file. An unauthenticated network actor who obtains or guesses the URL can retrieve persistent patient documents even when drive encryption is enabled. This issue is fixed in version 8.2.0.