PT-2023-15101 · Vocera · Vocera Voice Server+2

Published 2023-07-25 · Updated 2024-10-29 · CVE-2022-46900

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vocera Report Server and Voice Server versions 5.x through 5.8

Description An issue was discovered in the software, allowing Path Traversal in the Task Exec filename. The Vocera Report Console contains various jobs executed on the server at specified intervals, such as backup. An authenticated user can modify these entries, setting the executable path and parameters.

Recommendations For versions 5.x through 5.8, consider restricting access to the Task Exec filename to prevent Path Traversal attacks. As a temporary workaround, limit the ability of authenticated users to modify job entries in the Vocera Report Console. Restrict the setting of executable paths and parameters to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-46900

Affected Products

Vocera Report Console

Vocera Report Server

Vocera Voice Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-46900 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46900 · Vendor Advisory
• https://stryker.com/us/en/about/governance/cyber-security/product-security/vocera-report-server-vulnerabilities--cve-2022-46898--cve-2022-4.html · Note
• https://stryker.com/us/en/about/governance/cyber-security/product-security · Note
• https://t.me/cvenotify/55642 · Telegram Post
• https://t.me/cvenotify/55143 · Telegram Post
• https://t.me/cibsecurity/67271 · Telegram Post