Vulnerability Details : CVE-2022-42732

A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any folder accessible to the account assigned to the website’s application pool.

Vulnerability category: File inclusion

Published 2022-11-17 17:15:12

Updated 2022-11-21 20:08:08

Source Siemens AG

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-42732

Probability of exploitation activity in the next 30 days: 0.10%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 41 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2022-42732

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	nvd@nist.gov
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2022-42732

CWE-73 External Control of File Name or Path

The product allows user input to control or influence paths or file names that are used in filesystem operations.

Assigned by: productcert@siemens.com (Secondary)
CWE-610 Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-42732

https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697

Security Advisory
Vendor Advisory

CVEs referencing this url

Products affected by CVE-2022-42732

Siemens » Syngo Dynamics Cardiovascular Imaging And Information System
Versions before (<) va40g_hf01
cpe:2.3:a:siemens:syngo_dynamics_cardiovascular_imaging_and_information_system:*:*:*:*:*:*:*:*
Matching versions