# OpenEMR Security **URL:** \ **Category:** OpenEMR Development\ **Created:** [August 11, 2018, 5:43pm UTC](https://community.open-emr.org/t/openemr-security/10597 "2018-08-11T17:43:22Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![brady.miller](https://community.open-emr.org/user_avatar/community.open-emr.org/brady.miller/32/10178_2.png) [@brady.miller](https://community.open-emr.org/u/brady.miller)\ **Post date:** [August 11, 2018, 5:43pm UTC](https://community.open-emr.org/t/openemr-security/10597/1 "2018-08-11T17:43:22Z")
Hi, There have been recent articles about security vulnerabilities in OpenEMR. Here is the original report of the vulnerabilties: > **[Openemr\_insecurity.pdf](https://www.open-emr.org/wiki/images/1/11/Openemr_insecurity.pdf)** > > 726.90 KB Here’s a nice complete article discussing many of the details: > **[Numerous OpenEMR Security Flaws Found; Most Patched](https://www.govinfosecurity.com/numerous-openemr-security-flaws-found-most-patched-a-11304)** > > Nearly two dozen security weaknesses in OpenEMR - open source electronic medical record and practice management software - left patient data vulnerable to And here are 2 other useful articles: > **[Popular healthcare software OpenEMR contained multiple security flaws](https://www.teiss.co.uk/threats/openemr-security-flaws/)** > > As many as 30 security vulnerabilities were discovered by security researchers in OpenEMR, the most popular open-source electronic medical record and medical practice management solution in the world. > **[Health data 'put at risk by security bugs'](https://www.bbc.co.uk/news/technology-45083778)** > > Almost 100 million patients were affected worldwide, according to security researchers. Here are some questions that journalists have asked us along with our replies: **Any comment from OpenEMR about the vulnerabilities?** The OpenEMR community is very thankful to Project Insecurity for their report, which led to an improvement in OpenEMR’s security. Responsible security vulnerability reporting is an invaluable asset for OpenEMR and all open source projects. The OpenEMR community takes security seriously and considered this vulnerability report high priority since one of the reported vulnerabilities did not require authentication. A patch was promptly released and announced to the community. Additionally, all downstream packages and cloud offerings were patched. **Have all the problems cited in report indeed been patched?** The key vulnerability in this report is the Patient Portal Authentication Bypass, which essentially allows a bad actor to bypass authentication and gain access to OpenEMR (if the patient portal is turned on). All the other vulnerabilities require authentication. The Patient Portal Authentication Bypass, Multiple instances of SQL Injection, Unrestricted File Upload, Remote Code Execution, and Arbitrary File Actions vulnerabilities were all fixed. The Unauthenticated Information Disclosure and Unauthenticated Administrative Actions involve files that are removed after installation, so there was no fix needed. The CSRF was not fixed and OpenEMR is working on a mechanism, which will require substantial code changes, to prevent this in the next OpenEMR version. **What should healthcare entities who use OpenEMR need to do to address the issues? Any suggestions for those organizations?** They just need to install most recent patch at [https://www.open-emr.org/wiki/index.php/OpenEMR\_Patches](https://www.open-emr.org/wiki/index.php/OpenEMR_Patches) . New patches and security fixes are announced to the registration list in addition to OpenEMR’s online forum and social accounts (such as twitter, facebook, etc.). There is an online community at [open-emr.org](http://open-emr.org) that can provide free support in addition to a group of vendors that can provide professional support. **I understand that OpenEMR is used to manage between 90 million and 110 million patient records worldwide. Is that figure accurate? What countries are the biggest users of OpenEMR?** That figure is only an estimate and taken from this article in 2012: [http://www.openhealthnews.com/hotnews/openemr-continues-grow-popularity-and-use](http://www.openhealthnews.com/hotnews/openemr-continues-grow-popularity-and-use) OpenEMR is an open source software project and does not require registration. There is an optional registration which only collects email addresses, so the location of these OpenEMR users is not known. Hopefully the above information helps to inform the community. **Conclusion and plan moving forward:** I’m planning to focus more on OpenEMR’s security. We are working on a CSRF mechanism now and are going through OpenEMR’s codebase to remove all lingering sql-injection and XSS vulnerabilities. See here for ongoing updates in plan: [https://www.open-emr.org/wiki/index.php/Codebase\_Security](https://www.open-emr.org/wiki/index.php/Codebase_Security) If anybody is interested in helping with this effort, just let me know. Thanks, -Brady ---
**Author:** ![Meraz\_X01](https://community.open-emr.org/letter_avatar_proxy/v4/letter/m/6de8d8/32.png) [@Meraz\_X01](https://community.open-emr.org/u/Meraz_X01)\ **Post date:** [September 26, 2019, 8:52pm UTC](https://community.open-emr.org/t/openemr-security/10597/2 "2019-09-26T20:52:21Z")
Hey Brady, How can I report a new security bug in the last version ? ---
**Author:** ![brady.miller](https://community.open-emr.org/user_avatar/community.open-emr.org/brady.miller/32/10178_2.png) [@brady.miller](https://community.open-emr.org/u/brady.miller)\ **Post date:** [September 26, 2019, 8:58pm UTC](https://community.open-emr.org/t/openemr-security/10597/3 "2019-09-26T20:58:14Z")
hi @Meraz_X01 , Email it to me at [brady.g.miller@gmail.com](mailto:brady.g.miller@gmail.com). Prefer encrypted email, but not necessary. If able to encrypt, here’s my pgp key: [https://keybase.io/bradymiller/pgp\_keys.asc?fingerprint=8a93ddec0e320d5eb8a7994827def05b1a8a6d4f](https://keybase.io/bradymiller/pgp_keys.asc?fingerprint=8a93ddec0e320d5eb8a7994827def05b1a8a6d4f) thanks, -brady ---
**Author:** ![Meraz\_X01](https://community.open-emr.org/letter_avatar_proxy/v4/letter/m/6de8d8/32.png) [@Meraz\_X01](https://community.open-emr.org/u/Meraz_X01)\ **Post date:** [September 26, 2019, 9:30pm UTC](https://community.open-emr.org/t/openemr-security/10597/4 "2019-09-26T21:30:21Z")
I’ve sent you an email now. Please check and confirm it ^^ Thanks, Mera ---
**Author:** ![brady.miller](https://community.open-emr.org/user_avatar/community.open-emr.org/brady.miller/32/10178_2.png) [@brady.miller](https://community.open-emr.org/u/brady.miller)\ **Post date:** [September 27, 2019, 7:57am UTC](https://community.open-emr.org/t/openemr-security/10597/5 "2019-09-27T07:57:47Z")
hi @Meraz_X01 , Got it. I’ll get back to you via email within a couple days. Thanks, -brady ---
**Author:** ![Meraz\_X01](https://community.open-emr.org/letter_avatar_proxy/v4/letter/m/6de8d8/32.png) [@Meraz\_X01](https://community.open-emr.org/u/Meraz_X01)\ **Post date:** [September 27, 2019, 8:07am UTC](https://community.open-emr.org/t/openemr-security/10597/6 "2019-09-27T08:07:24Z")
Hi @brady.miller, Take your time. Glad to help 🙂 Thanks, Mera ---
**Author:** ![Meraz\_X01](https://community.open-emr.org/letter_avatar_proxy/v4/letter/m/6de8d8/32.png) [@Meraz\_X01](https://community.open-emr.org/u/Meraz_X01)\ **Post date:** [September 29, 2019, 8:42pm UTC](https://community.open-emr.org/t/openemr-security/10597/7 "2019-09-29T20:42:59Z")
Hi @brady.miller, Please check your mail for another vulnerability ^^ Regards, Mera ---
**Author:** ![brady.miller](https://community.open-emr.org/user_avatar/community.open-emr.org/brady.miller/32/10178_2.png) [@brady.miller](https://community.open-emr.org/u/brady.miller)\ **Post date:** [September 30, 2019, 5:20am UTC](https://community.open-emr.org/t/openemr-security/10597/8 "2019-09-30T05:20:30Z")
hi @Meraz_X01 , Got it and sent you an email. That one will take me a bit longer. -brady