CVE-2022-42732

A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any folder accessible to the account assigned to the website’s application pool.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697	Vendor Advisory
https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:siemens:syngo_dynamics_cardiovascular_imaging_and_information_system:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:25

Type	Values Removed	Values Added
References	~~() https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697 - Vendor Advisory~~	() https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697 - Vendor Advisory

Information

Published : 2022-11-17 17:15

Updated : 2024-11-21 07:25

NVD link : CVE-2022-42732

Mitre link : CVE-2022-42732

CVE.ORG link : CVE-2022-42732

JSON object : View

Products Affected

siemens

syngo_dynamics_cardiovascular_imaging_and_information_system

CWE

CWE-73

External Control of File Name or Path

CWE-610

Externally Controlled Reference to a Resource in Another Sphere

{"id": "CVE-2022-42732", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-11-17T17:15:11.673", "references": [{"url": "https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}, {"url": "https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-73"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-610"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any folder accessible to the account assigned to the website\u2019s application pool."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en syngo Dynamics (todas las versiones < VA40G HF01). El servidor de aplicaciones syngo Dynamics aloja un servicio web mediante una operaci\u00f3n con control de acceso de lectura inadecuado que podr\u00eda permitir recuperar archivos desde cualquier carpeta accesible a la cuenta asignada al grupo de aplicaciones del sitio web."}], "lastModified": "2024-11-21T07:25:14.430", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:syngo_dynamics_cardiovascular_imaging_and_information_system:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B2F3FBF4-8431-4C9D-8173-CA6DEC1104F0", "versionEndExcluding": "va40g_hf01"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}