PT-2022-26648 · Siemens · Syngo Dynamics

Ryan Wincey · Published 2022-11-17 · Updated 2022-11-21 · CVE-2022-42894

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions syngo Dynamics versions prior to VA40G HF01

Description A Server-Side Request Forgery (SSRF) vulnerability was identified in one of the web services exposed on the syngo Dynamics application. This could allow for the leaking of NTLM credentials as well as local service enumeration.

Recommendations For versions prior to VA40G HF01, update to VA40G HF01 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable web service to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-42894

Affected Products

Syngo Dynamics

References · 4

• https://osv.dev/vulnerability/CVE-2022-42894 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42894 · Security Note
• https://siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697 · Vendor Advisory
• https://t.me/cibsecurity/53082 · Telegram Post