PT-2022-26524 · Siemens · Syngo Dynamics

Published 2022-11-17 · Updated 2022-11-21 · CVE-2022-42733

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions syngo Dynamics versions prior to VA40G HF01

Description A vulnerability has been identified in the syngo Dynamics application server, which hosts a web service using an operation with improper read access control. This could allow files to be retrieved from any folder accessible to the account assigned to the website’s application pool.

Recommendations For versions prior to VA40G HF01, update to VA40G HF01 or later to resolve the issue. As a temporary workaround, consider restricting access to the web service or implementing proper read access control to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-610

CWE-73

Related Identifiers

CVE-2022-42733

Affected Products

Syngo Dynamics

References · 4

• https://osv.dev/vulnerability/CVE-2022-42733 · Vendor Advisory
• https://siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42733 · Security Note
• https://t.me/cibsecurity/53070 · Telegram Post