PT-2022-4508 · Bd · Bd Synapsys

Published 2022-05-31 · Updated 2022-06-10 · CVE-2022-30277

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions BD Synapsys versions 4.20 through 4.30

Description The issue is related to an insufficient session expiration, which could allow threat actors to access, modify, or delete sensitive information, including electronic protected health information (ePHI), protected health information (PHI), and personally identifiable information (PII).

Recommendations For versions 4.20, 4.20 SR1, and 4.30, consider implementing additional security measures to enforce proper session expiration until a patch is available. As a temporary workaround, restrict access to sensitive information to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

BDU:2022-05376

CVE-2022-30277

Affected Products

Bd Synapsys

References · 6

• https://cybersecurity.bd.com/bulletins-and-patches/bd-synapsys-insufficient-session-expiration · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05376 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-30277 · Security Note
• https://osv.dev/vulnerability/CVE-2022-30277 · Vendor Advisory
• https://us-cert.gov/ics/advisories/icsma-22-151-02 · Note
• https://t.me/cibsecurity/43688 · Telegram Post