CVE-2021-39369

Опубликовано: 26 дек. 2022

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

In Philips (formerly Carestream) Vue MyVue PACS through 12.2.x.x, the VideoStream function allows Path Traversal by authenticated users to access files stored outside of the web root.

Ссылки

https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01
Mitigation
Third Party Advisory
US Government Resource
https://www.usa.philips.com/healthcare
Vendor Advisory
https://www.youtube.com/watch?v=7zC84TNpIxw
Product
https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01
Mitigation
Third Party Advisory
US Government Resource
https://www.usa.philips.com/healthcare
Vendor Advisory
https://www.youtube.com/watch?v=7zC84TNpIxw
Product

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:philips:myvue:-:*:*:*:*:*:*:*

cpe:2.3:a:philips:speech:-:*:*:*:*:*:*:*

cpe:2.3:a:philips:vue_motion:*:*:*:*:*:*:*:*

Версия до 12.2.1.5 (включая)

cpe:2.3:a:philips:vue_pacs:-:*:*:*:*:*:*:*

EPSS

Процентиль: 61%

0.00419

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-22

Связанные уязвимости

GHSA-g3cv-mvp2-4vfj