Summaryinfo

A vulnerability was found in OpenEMR up to 7.0.3.0. It has been rated as critical. This affects an unknown function. Performing a manipulation results in server-side request forgery. This vulnerability is identified as CVE-2025-31117. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Detailsinfo

A vulnerability classified as critical has been found in OpenEMR up to 7.0.3.0. This affects an unknown function. The manipulation with an unknown input leads to a server-side request forgery vulnerability. CWE is classifying the issue as CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This is going to have an impact on confidentiality. The summary by CVE is:

OpenEMR is a free and open source electronic health records and medical practice management application. An Out-of-Band Server-Side Request Forgery (OOB SSRF) vulnerability was identified in OpenEMR, allowing an attacker to force the server to make unauthorized requests to external or internal resources. this attack does not return a direct response but can be exploited through DNS or HTTP interactions to exfiltrate sensitive information. This vulnerability is fixed in 7.0.3.1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-31117 since 03/26/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 7.0.3.1 eliminates this vulnerability. Applying the patch aa6f50efb2971285633fa77ea7a50949408cab12 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Business Process Management Software

Name

• OpenEMR

Version

• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3.0

License

• open-source

Website

• Product: https://github.com/openemr/openemr/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion