Description
OpenEMR before 8.5.0 contains a missing authorization vulnerability in InstallerController that allows any authenticated user to modify module administration settings without the admin/manage_modules permission. Low-privileged users such as Front Office clerks can POST to saveConfig, DeleteAcl, DeleteHooks and nickName actions to reconfigure or partially disable installed modules.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Open-Emr | OpenEMR | 0 <8.5.0 | — |