PT-2023-15102 · Vocera · Vocera Voice Server+2

CVE-2022-46901 · Publicado 2023-07-25 · Atualizado 2023-08-01

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vocera Report Server and Voice Server versions 5.x through 5.8

Description An issue was discovered that allows for an Access Control Violation for Database Operations. The Vocera Report Console contains a websocket interface that permits the unauthenticated execution of various tasks and database functions, including system tasks, and backing up, loading, and clearing of the database.

Recommendations For versions 5.x through 5.8, consider disabling the websocket interface in the Vocera Report Console until a patch is available to prevent unauthenticated execution of tasks and database functions. Restrict access to the Vocera Report Console to minimize the risk of exploitation. Avoid using the websocket interface for database operations until the issue is resolved.

Correção

Exposure of Resource to Wrong Sphere

Enumeração de Fraquezas

CWE-668

Identificadores relacionados

CVE-2022-46901

Produtos afetados

Vocera Report Console

Vocera Report Server

Vocera Voice Server

Referências · 7

• https://stryker.com/us/en/about/governance/cyber-security/product-security/vocera-report-server-vulnerabilities--cve-2022-46898--cve-2022-4.html · Nota
• https://osv.dev/vulnerability/CVE-2022-46901 · Aviso do Fabricante
• https://t.me/cvenotify/55142 · Publicação no Telegram
• https://t.me/cibsecurity/67256 · Publicação no Telegram
• https://stryker.com/us/en/about/governance/cyber-security/product-security · Nota
• https://t.me/cvenotify/55643 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-46901 · Nota de Segurança