PT-2022-6737 · Dcmtk+5 · Dcmtk+5

Published 2022-05-06 · Updated 2025-06-24 · CVE-2022-2120

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions DCMTK versions prior to 3.6.7

Description The issue is related to a relative path traversal vulnerability in the service class user (SCU) of DCMTK, which allows an attacker to write DICOM files into arbitrary directories under controlled names. This could potentially lead to remote code execution. The vulnerability is also associated with insufficient restrictions on directory path names, enabling a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For versions prior to 3.6.7, update to version 3.6.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the SCU service to minimize the risk of exploitation.

Fix

RCE

Path traversal

Relative Path Traversal

Weakness Enumeration

CWE-22

CWE-23

Related Identifiers

ALT-PU-2024-15767

ALT-PU-2024-5081

ALT-PU-2025-4731

BDU:2023-03841

CVE-2022-2120

DLA-4227-1

MGASA-2023-0083

OPENSUSE-SU-2022:10144-1

OPENSUSE-SU-2022:10145-1

OPENSUSE-SU-2023:0108-1

ROSA-SA-2025-2643

USN-5882-1

Affected Products

Alt Linux

Astra Linux

Dcmtk

Debian

Linuxmint

Ubuntu

References · 50

• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0907SE47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8979 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43272 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-2120 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0630SE17MD · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2121 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0083.html · Security Note
• https://cve.org/CVERecord?id=CVE-2022-2120 · Security Note
• https://osv.dev/vulnerability/DLA-4227-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/2Z7WVDK43MKWOS23BIN4VCQRQRXHGSDB · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2120 · Security Note
• https://ubuntu.com/security/CVE-2022-2119 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-41689 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5882-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0083 · Vendor Advisory