CyberRota Analysis
AI-GeneratedOpenEMR versions prior to 8.3.0 are vulnerable to a cross-site request forgery (CSRF) attack in the DICOM viewer, where the unsanitized web_path GET parameter allows attackers to manipulate authenticated user sessions. This vulnerability can lead to unauthorized actions such as forced logouts and other state changes by exploiting users with Patients - Documents permissions. Organizations using affected versions should prioritize patching to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The web_path GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with Patients - Documents permissions to make authenticated requests to arbitrary OpenEMR endpoints, enabling forced logout and other state-changing actions.