CVE-2022-42891

A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder accessible to the account assigned to the website’s application pool.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697	Vendor Advisory
https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:siemens:syngo_dynamics_cardiovascular_imaging_and_information_system:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:25

Type	Values Removed	Values Added
References	~~() https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697 - Vendor Advisory~~	() https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697 - Vendor Advisory

Information

Published : 2022-11-17 17:15

Updated : 2024-11-21 07:25

NVD link : CVE-2022-42891

Mitre link : CVE-2022-42891

CVE.ORG link : CVE-2022-42891

JSON object : View

Products Affected

siemens

syngo_dynamics_cardiovascular_imaging_and_information_system

CWE

CWE-73

External Control of File Name or Path

CWE-610

Externally Controlled Reference to a Resource in Another Sphere

{"id": "CVE-2022-42891", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-11-17T17:15:12.577", "references": [{"url": "https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}, {"url": "https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-73"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-610"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder accessible to the account assigned to the website\u2019s application pool."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en syngo Dynamics (todas las versiones < VA40G HF01). El servidor de aplicaciones syngo Dynamics aloja un servicio web mediante una operaci\u00f3n con control de acceso de escritura inadecuado que podr\u00eda permitir escribir datos en cualquier carpeta accesible a la cuenta asignada al grupo de aplicaciones del sitio web."}], "lastModified": "2024-11-21T07:25:32.437", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:syngo_dynamics_cardiovascular_imaging_and_information_system:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B2F3FBF4-8431-4C9D-8173-CA6DEC1104F0", "versionEndExcluding": "va40g_hf01"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}