Test ID:	1.3.6.1.4.1.25623.1.0.105316
Category:	Web application abuses
Title:	OpenEMR 'interface/globals.php' Authentication Bypass Vulnerability
Summary:	OpenEMR is prone to an authentication-bypass vulnerability.
Description:	Summary: OpenEMR is prone to an authentication-bypass vulnerability. Vulnerability Insight: A bug in OpenEMR's implementation of 'fake register_globals' in interface/globals.php allows an attacker to bypass authentication by sending ignoreAuth=1 as a GET or POST request parameter. Vulnerability Impact: An attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions. This may aid in further attacks. Affected Software/OS: OpenEMR versions 2.8.3 through 4.2.0 patch 1 are vulnerable. Solution: Updates are available. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-4453 BugTraq ID: 75299 http://www.securityfocus.com/bid/75299 http://seclists.org/fulldisclosure/2015/Jun/48 http://jvn.jp/en/jp/JVN22677713/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2015-000092 http://packetstormsecurity.com/files/132368/OpenEMR-4.2.0-Authentication-Bypass.html http://www.open-emr.org/wiki/index.php/OpenEMR_Patches
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.