PT-2022-26525 · Siemens · Syngo Dynamics

Published 2022-11-17 · Updated 2022-11-21 · CVE-2022-42734

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions syngo Dynamics versions prior to VA40G HF01

Description A vulnerability has been identified in the syngo Dynamics application server, which hosts a web service using an operation with improper write access control. This could allow writing data in any folder accessible to the account assigned to the website's application pool.

Recommendations For versions prior to VA40G HF01, update to VA40G HF01 or later to resolve the issue. As a temporary workaround, consider restricting write access to sensitive folders to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-610

CWE-73

Related Identifiers

CVE-2022-42734

Affected Products

Syngo Dynamics

References · 4

• https://siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42734 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42734 · Vendor Advisory
• https://t.me/cibsecurity/53073 · Telegram Post