OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading

Overview

OpenEMR is a free and open source electronic health records and medical practice management application. From 6.0.0 until 8.3.0, interface/globals.php uses the unauthenticated authUser login parameter to populate temp_authuserid and load that account's user_settings before authentication succeeds. Existing usernames can therefore cause an additional database query and may apply visible customized settings, while nonexistent usernames skip that behavior. A remote unauthenticated actor can use timing or page differences to enumerate valid accounts for later credential attacks. This issue is fixed in version 8.3.0.

Affected

• openemr >= 6.0.0, < 8.3.0

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.