PT-2022-26646 · Siemens · Syngo Dynamics

Published 2022-11-17 · Updated 2022-11-21 · CVE-2022-42892

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions syngo Dynamics versions prior to VA40G HF01

Description A vulnerability has been identified in the syngo Dynamics application server, which hosts a web service using an operation with improper write access control. This could allow directory listing in any folder accessible to the account assigned to the website's application pool.

Recommendations For versions prior to VA40G HF01, update to VA40G HF01 or later to resolve the issue. As a temporary workaround, consider restricting access to the web service operation to minimize the risk of exploitation.

Fix

Path traversal

Relative Path Traversal

Weakness Enumeration

CWE-22

CWE-23

Related Identifiers

CVE-2022-42892

Affected Products

Syngo Dynamics

References · 4

• https://osv.dev/vulnerability/CVE-2022-42892 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42892 · Security Note
• https://siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697 · Vendor Advisory
• https://t.me/cibsecurity/53068 · Telegram Post