Description
OpenEMR before 8.4.0 contains an improper authorization vulnerability in ScopeRepository::finalizeScopes() that allows read-only SMART/OAuth clients to obtain write scopes because ScopeEntity::containsScope() ignores registered permissions. Attackers with a client registered for user/<resource>.read can request user/<resource>.write to create, update, and delete appointments or patient data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Open-Emr | OpenEMR | 0 <8.4.0 | — |