CVE-2022-42892

A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow directory listing in any folder accessible to the account assigned to the website’s application pool.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697	Vendor Advisory
https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:siemens:syngo_dynamics_cardiovascular_imaging_and_information_system:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:25

Type	Values Removed	Values Added
References	~~() https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697 - Vendor Advisory~~	() https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697 - Vendor Advisory

Information

Published : 2022-11-17 17:15

Updated : 2024-11-21 07:25

NVD link : CVE-2022-42892

Mitre link : CVE-2022-42892

CVE.ORG link : CVE-2022-42892

JSON object : View

Products Affected

siemens

syngo_dynamics_cardiovascular_imaging_and_information_system

CWE

CWE-23

Relative Path Traversal

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2022-42892", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2022-11-17T17:15:12.880", "references": [{"url": "https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}, {"url": "https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-23"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow directory listing in any folder accessible to the account assigned to the website\u2019s application pool."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en syngo Dynamics (todas las versiones < VA40G HF01). El servidor de aplicaciones syngo Dynamics aloja un servicio web mediante una operaci\u00f3n con control de acceso de escritura inadecuado que podr\u00eda permitir el listado de directorios en cualquier carpeta accesible a la cuenta asignada al grupo de aplicaciones del sitio web."}], "lastModified": "2024-11-21T07:25:32.580", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:syngo_dynamics_cardiovascular_imaging_and_information_system:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B2F3FBF4-8431-4C9D-8173-CA6DEC1104F0", "versionEndExcluding": "va40g_hf01"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}