OpenEMR versions before 7.0.4 are vulnerable to man-in-the-middle attacks due to disabled SSL/TLS certificate verification, which could lead to the interception or manipulation of sensitive healthcare data.

The application utilizes an HTTP client wrapper that disables SSL/TLS certificate verification by default. This flaw allows an unauthenticated attacker to conduct man-in-the-middle attacks against external API communications, potentially exposing Protected Health Information (PHI).

The vulnerability carries a CVSS score of 8.1, reflecting a high potential for impact on confidentiality, integrity, and availability. Successful exploitation could result in the compromise of sensitive medical records and unauthorized manipulation of data transmitted to government healthcare services or external providers, leading to severe regulatory non-compliance and loss of patient trust.

Immediate Action: Upgrade the OpenEMR installation to version 7.0.4 or later to ensure proper SSL/TLS certificate validation is enforced.

Proactive Monitoring: Review system logs for unusual outbound connection patterns or errors related to SSL/TLS handshake failures, which may indicate interception attempts.

Compensating Controls: Implement strict network egress filtering to restrict traffic from the OpenEMR server to only known and trusted external API endpoints, reducing the surface area for malicious interception.

Public Exploit Available: No (exploit_available: unknown)

Given the critical nature of the data managed by OpenEMR, the risk of data interception via man-in-the-middle attacks is significant. Organizations should prioritize updating to version 7.0.4 immediately. If an update cannot be performed today, ensure that all external service integrations are audited and that network-level security controls are in place to monitor and limit outbound traffic from the application environment.