CVE-2022-2120CWE-23
OFFIS DCMTK Path Traversal
High · published June 24, 2022
What it is
OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.
The record
Technical detail
- CVSS v3.1
- 7.5 · HIGH
- Vector
- CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.03288 · 88.4th percentile
- Weakness
- CWE-23 · Relative Path Traversal
- Published
- 2022-06-24T15:00Z
EPSS history
Timeline