CVE-2015-4453

interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts, as demonstrated by (1) interface/fax/fax_dispatch_newpid.php and (2) interface/billing/sl_eob_search.php.

• CWE-287

• http://jvn.jp/en/jp/JVN22677713/index.htmlVendor Advisory
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000092Vendor Advisory
• http://packetstormsecurity.com/files/132368/OpenEMR-4.2.0-Authentication-Bypass.html
• http://seclists.org/fulldisclosure/2015/Jun/48
• http://www.open-emr.org/wiki/index.php/OpenEMR_PatchesPatch, Vendor Advisory
• http://www.securityfocus.com/bid/75299
• http://jvn.jp/en/jp/JVN22677713/index.htmlVendor Advisory
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000092Vendor Advisory
• http://packetstormsecurity.com/files/132368/OpenEMR-4.2.0-Authentication-Bypass.html
• http://seclists.org/fulldisclosure/2015/Jun/48
• http://www.open-emr.org/wiki/index.php/OpenEMR_PatchesPatch, Vendor Advisory
• http://www.securityfocus.com/bid/75299

Published

Jul 5, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-4447Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before…
• CVE-2015-4448Use-after-free vulnerability in Adobe Reader and Acrobat 10.…
• CVE-2015-4449Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before…
• CVE-2015-4450Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before…
• CVE-2015-4451Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before…
• CVE-2015-4452Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before…
• CVE-2015-4454SQL injection vulnerability in the get_hash_graph_template f…
• CVE-2015-4455Unrestricted file upload vulnerability in includes/upload.ph…
• CVE-2015-4456ownCloud Desktop Client before 1.8.2 does not call QNetworkR…
• CVE-2015-4457Multiple cross-site scripting (XSS) vulnerabilities in the C…5.4
• CVE-2015-4458The TLS implementation in the Cavium cryptographic-module fi…
• CVE-2015-4460Cross-site request forgery (CSRF) vulnerability in SecurityS…