PT-2023-15102 · Vocera · Vocera Voice Server+2

Published 2023-07-25 · Updated 2023-08-01 · CVE-2022-46901

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vocera Report Server and Voice Server versions 5.x through 5.8

Description An issue was discovered that allows for an Access Control Violation for Database Operations. The Vocera Report Console contains a websocket interface that permits the unauthenticated execution of various tasks and database functions, including system tasks, and backing up, loading, and clearing of the database.

Recommendations For versions 5.x through 5.8, consider disabling the websocket interface in the Vocera Report Console until a patch is available to prevent unauthenticated execution of tasks and database functions. Restrict access to the Vocera Report Console to minimize the risk of exploitation. Avoid using the websocket interface for database operations until the issue is resolved.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2022-46901

Affected Products

Vocera Report Console

Vocera Report Server

Vocera Voice Server

References · 7

• https://osv.dev/vulnerability/CVE-2022-46901 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46901 · Security Note
• https://stryker.com/us/en/about/governance/cyber-security/product-security/vocera-report-server-vulnerabilities--cve-2022-46898--cve-2022-4.html · Note
• https://t.me/cvenotify/55142 · Telegram Post
• https://t.me/cibsecurity/67256 · Telegram Post
• https://stryker.com/us/en/about/governance/cyber-security/product-security · Note
• https://t.me/cvenotify/55643 · Telegram Post