PT-2023-15099 · Vocera · Vocera Voice Server+2
Publicado
2023-07-25
·
Atualizado
2023-08-01
·
CVE-2022-46898
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Vocera Report Server and Voice Server versions 5.x through 5.8
Description
An issue was discovered that allows for Path Traversal via the
filename provided for the "restore SQL data" functionality. The Vocera Report Console contains a websocket function that allows for the restoration of the database from a ZIP archive expecting a SQL import file. However, the filename is not properly sanitized, allowing for the inclusion of a path-traversal payload to escape the intended Vocera restoration directory. An attacker could exploit this to point to a crafted ZIP archive containing SQL commands that could be executed against the database.Recommendations
For Vocera Report Server and Voice Server versions 5.x through 5.8, consider disabling the websocket function related to the "restore SQL data" feature until a patch is available. Restrict access to the database restoration functionality to minimize the risk of exploitation. Avoid using unsanitized filenames in the affected functionality to prevent path-traversal attacks.
Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Vocera Report Console
Vocera Report Server
Vocera Voice Server