CVE-2022-42892 Path traversal in syngo Dynamics
An attacker can list directories in any folder accessible to the application pool due to improper write access control in the web service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-42892?
CVE-2022-42892 is a medium-severity path traversal vulnerability in Siemens syngo Dynamics, published on 17 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow directory listing in any folder accessible to the account assigned to the website’s application pool.
Which versions are affected by CVE-2022-42892?
It affects 1 product.
Products include Siemens Syngo Dynamics Cardiovascular Imaging and Information System.
How do I fix CVE-2022-42892?
No fix has been published for CVE-2022-42892 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-42892 being exploited?
There is no known exploitation of CVE-2022-42892 in the wild and no public exploit code.
Other vulnerabilities in Siemens syngo Dynamics
Sources
Also known as GHSA-53rw-gcgw-2723.