A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). An unauthenticated Server-Side Request Forgery (SSRF) vulnerability was identified in one of the web services exposed on the syngo Dynamics application that could allow for the leaking of NTLM credentials as well as local service enumeration.
References
| Link | Resource |
|---|---|
| https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2022, 17:53
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:a:siemens:syngo_dynamics_cardiovascular_imaging_and_information_system:*:*:*:*:*:*:*:* | |
| References | (MISC) https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697 - Vendor Advisory | |
| CWE | CWE-918 | |
| First Time |
Siemens
Siemens syngo Dynamics Cardiovascular Imaging And Information System |
17 Nov 2022, 17:42
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-11-17 17:15
Updated : 2023-12-10 14:48
NVD link : CVE-2022-42894
Mitre link : CVE-2022-42894
CVE.ORG link : CVE-2022-42894
JSON object : View
Products Affected
siemens
- syngo_dynamics_cardiovascular_imaging_and_information_system
CWE
CWE-918
Server-Side Request Forgery (SSRF)