Search
Find a vulnerability
Search criteria
1 vulnerability found for OpenEMR by Open-Emr
CVE-2023-54347 (GCVE-0-2023-54347)
Vulnerability from cvelistv5 – Published: 2026-05-05 11:24 – Updated: 2026-05-06 14:08
VLAI
EPSS
VEX
Title
OpenEMR 7.0.1 Authentication Brute Force Mitigation Bypass
Summary
OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts to the main login endpoint. Attackers can submit POST requests with authUser and clearPass parameters to systematically test username and password combinations without account lockout restrictions.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-06 14:08 UTC
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://www.exploit-db.com/exploits/51413 | exploit |
| https://www.open-emr.org/ | product |
| https://github.com/openemr/openemr/archive/refs/t… | product |
| https://www.vulncheck.com/advisories/openemr-auth… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Open-Emr | OpenEMR |
Affected:
7.0.1
cpe:2.3:a:open-emr:openemr:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:open-emr:openemr:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:open-emr:openemr:8.0.0:*:*:*:*:*:*:* cpe:2.3:a:open-emr:openemr:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:open-emr:openemr:7.0.3.1:*:*:*:*:*:*:* cpe:2.3:a:open-emr:openemr:7.3.0:*:*:*:*:*:*:* cpe:2.3:a:open-emr:openemr:7.0.2.1:*:*:*:*:*:*:* cpe:2.3:a:open-emr:openemr:7.0.2.2:*:*:*:*:*:*:* cpe:2.3:a:open-emr:openemr:7.0.2.3:*:*:*:*:*:*:* cpe:2.3:a:open-emr:openemr:7.0.3.2:*:*:*:*:*:*:* cpe:2.3:a:open-emr:openemr:7.0.3.3:*:*:*:*:*:*:* cpe:2.3:a:open-emr:openemr:7.0.3.4:*:*:*:*:*:*:* |
Date Public
2023-04-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-54347",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-06T14:08:31.548886Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-06T14:08:52.856Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "OpenEMR",
"vendor": "Open-Emr",
"versions": [
{
"status": "affected",
"version": "7.0.1"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:open-emr:openemr:7.0.1:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:open-emr:openemr:7.0.4:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:open-emr:openemr:8.0.0:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:open-emr:openemr:7.0.3:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:open-emr:openemr:7.0.3.1:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:open-emr:openemr:7.3.0:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:open-emr:openemr:7.0.2.1:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:open-emr:openemr:7.0.2.2:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:open-emr:openemr:7.0.2.3:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:open-emr:openemr:7.0.3.2:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:open-emr:openemr:7.0.3.3:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:open-emr:openemr:7.0.3.4:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "abhhi (Abhishek Birdawade)"
}
],
"datePublic": "2023-04-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts to the main login endpoint. Attackers can submit POST requests with authUser and clearPass parameters to systematically test username and password combinations without account lockout restrictions."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-05T11:24:50.970Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "ExploitDB-51413",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/51413"
},
{
"name": "Official Product Homepage",
"tags": [
"product"
],
"url": "https://www.open-emr.org/"
},
{
"name": "Product Reference",
"tags": [
"product"
],
"url": "https://github.com/openemr/openemr/archive/refs/tags/v7_0_1.tar.gz"
},
{
"name": "VulnCheck Advisory: OpenEMR 7.0.1 Authentication Brute Force Mitigation Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openemr-authentication-brute-force-mitigation-bypass"
}
],
"title": "OpenEMR 7.0.1 Authentication Brute Force Mitigation Bypass",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2023-54347",
"datePublished": "2026-05-05T11:24:50.970Z",
"dateReserved": "2026-01-10T01:51:52.985Z",
"dateUpdated": "2026-05-06T14:08:52.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}