CVE-2022-42732 Path traversal in syngo Dynamics
An attacker can retrieve files from any folder accessible to the application pool due to improper read access control in the web service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-42732?
CVE-2022-42732 is a high-severity path traversal vulnerability in Siemens syngo Dynamics, published on 17 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any folder accessible to the account assigned to the website’s application pool.
Which versions are affected by CVE-2022-42732?
It affects 1 product.
Products include Siemens Syngo Dynamics Cardiovascular Imaging and Information System.
How do I fix CVE-2022-42732?
No fix has been published for CVE-2022-42732 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-42732 being exploited?
There is no known exploitation of CVE-2022-42732 in the wild and no public exploit code.
Other vulnerabilities in Siemens syngo Dynamics
Sources
Also known as GHSA-h4pp-x3cc-f8mv.