CVE-2022-42891 Path traversal in syngo Dynamics
An attacker can write data to arbitrary folders on the syngo Dynamics application server due to improper write access controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-42891?
CVE-2022-42891 is a high-severity path traversal vulnerability in Siemens syngo Dynamics, published on 17 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder accessible to the account assigned to the website’s application pool.
Which versions are affected by CVE-2022-42891?
It affects 1 product.
Products include Siemens Syngo Dynamics Cardiovascular Imaging and Information System.
How do I fix CVE-2022-42891?
No fix has been published for CVE-2022-42891 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-42891 being exploited?
There is no known exploitation of CVE-2022-42891 in the wild and no public exploit code.
Other vulnerabilities in Siemens syngo Dynamics
Sources
Also known as GHSA-9xhg-4cw3-p79r.