PT-2023-15099 · Vocera · Vocera Voice Server+2

Published 2023-07-25 · Updated 2023-08-01 · CVE-2022-46898

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vocera Report Server and Voice Server versions 5.x through 5.8

Description An issue was discovered that allows for Path Traversal via the filename provided for the "restore SQL data" functionality. The Vocera Report Console contains a websocket function that allows for the restoration of the database from a ZIP archive expecting a SQL import file. However, the filename is not properly sanitized, allowing for the inclusion of a path-traversal payload to escape the intended Vocera restoration directory. An attacker could exploit this to point to a crafted ZIP archive containing SQL commands that could be executed against the database.

Recommendations For Vocera Report Server and Voice Server versions 5.x through 5.8, consider disabling the websocket function related to the "restore SQL data" feature until a patch is available. Restrict access to the database restoration functionality to minimize the risk of exploitation. Avoid using unsanitized filenames in the affected functionality to prevent path-traversal attacks.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-46898

Affected Products

Vocera Report Console

Vocera Report Server

Vocera Voice Server

References · 7

• https://osv.dev/vulnerability/CVE-2022-46898 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46898 · Security Note
• https://stryker.com/us/en/about/governance/cyber-security/product-security/vocera-report-server-vulnerabilities--cve-2022-46898--cve-2022-4.html · Note
• https://t.me/cvenotify/55640 · Telegram Post
• https://stryker.com/us/en/about/governance/cyber-security/product-security · Note
• https://t.me/cvenotify/55145 · Telegram Post
• https://t.me/cibsecurity/67254 · Telegram Post