Improper Access Control in Siemens Healthineers' syngo Dynamics Application
CVE-2022-42892

5.3MEDIUM

Key Information:

Vendor
Siemens
Status
Syngo Dynamics
Vendor
CVE Published:
17 November 2022

Summary

A vulnerability has been discovered in the syngo Dynamics application server, where improper write access control allows for directory listing in accessible folders by the account linked to the website's application pool. This creates a significant security risk as sensitive data may be exposed to unauthorized users. Users of syngo Dynamics should ensure they are running versions at or above VA40G HF01 to mitigate this issue.

Affected Version(s)

syngo Dynamics All versions < VA40G HF01

References

https://www.siemens-healthineers.com/en-us/support-docume...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.