CVE-2015-4453
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers...
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts, as demonstrated by (1) interface/fax/fax_dispatch_newpid.php and (2) interface/billing/sl_eob_search.php.
Exploit likelihood
What each source reports
NVD Score used
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts, as demonstrated by (1) interface/fax/fax_dispatch_newpid.php and (2) interface/billing/sl_eob_search.php.
- Record
CVE-2015-4453- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts, as demonstrated by (1) interface/fax/fax_dispatch_newpid.php and (2) interface/billing/sl_eob_search.php.
- Record
CVE-2015-4453- Updated
- 2026-11-02
EUVDEUVD-2015-4473 No score
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts, as demonstrated by (1) interface/fax/fax_dispatch_newpid.php and (2) interface/billing/sl_eob_search.php.
- Record
EUVD-2015-4473- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2mm4-c3cw-4h46 No score
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers...
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts, as demonstrated by (1) interface/fax/fax_dispatch_newpid.php and (2) interface/billing/sl_eob_search.php.
- Record
GHSA-2mm4-c3cw-4h46- Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-4453 is a medium vulnerability (CVSS 5.0) in Open-emr Openemr, published July 5, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.85%, the 86th percentile. No source names a fixed version.
References
seclists.org/fulldisclosure/2015/Jun/48
jvndb.jvn.jp/jvndb/JVNDB-2015-000092
packetstormsecurity.com/files/132368/OpenEMR-4.2.0-Authentication-Bypass.html
jvn.jp/en/jp/JVN22677713/index.html
open-emr.org/wiki/index.php/OpenEMR_Patches
securityfocus.com/bid/75299
nvd.nist.gov/vuln/detail/CVE-2015-4453
github.com/advisories/GHSA-2mm4-c3cw-4h46