Improper Write Access Control in Siemens syngo Dynamics Application Server
CVE-2022-42891

7.5HIGH

Key Information:

Vendor

Siemens
Status
Syngo Dynamics
Vendor
CVE Published:
17 November 2022

What is CVE-2022-42891?

A vulnerability exists in the syngo Dynamics application server, where improper write access control on a web service allows unauthorized users to write data to any folder that is accessible by the application pool's assigned account. This flaw exposes sensitive data and can lead to various security breaches if not addressed promptly.

Affected Version(s)

syngo Dynamics All versions < VA40G HF01

References

https://www.siemens-healthineers.com/en-us/support-docume...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.