CVE-2022-2119CWE-22
OFFIS DCMTK Path Traversal
High · published June 24, 2022
What it is
OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.
The record
Technical detail
- CVSS v3.1
- 7.5 · HIGH
- Vector
- CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.03288 · 88.4th percentile
- Weakness
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Published
- 2022-06-24T15:00Z
EPSS history
Timeline