OpenEMR is the world’s most popular open source electronic health records and medical practice management solution, and is used globally to manage millions of patient records.
We recently discovered several security vulnerabilities within Version 5.0.1(6) with potentially severe implications. While these issues have been resolved in Version 5.0.2, the wide distribution of earlier versions plus the impact of successful exploitation requires us to publish the details of our discoveries.
Identified vulnerabilities include remote code execution (CVE-2019-8371) and several instances of cross-site scripting (CVE-2019-8368). Successful exploitation of the identified vulnerabilities could lead to server compromise and allow an administrative attacker to execute code on the underlying server. In all situations, sensitive patient information would be at risk.
As of this writing, OpenEMR has announced no plans to issue further patches for Version 5.0.1. While unconfirmed, we also highly suspect these vulnerabilities exist in earlier releases. Users are strongly urged to upgrade to Version 5.0.2, which rectifies these issues.