CVE-2022-46900

· MEDIUMModified

← All CVEs

CVSS v3.1

6.5

EPSS

0.58%

Published

Jul 25, 2023

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is Path Traversal in the Task Exec filename. The Vocera Report Console contains various jobs that are executed on the server at specified intervals, e.g., backup, etc. An authenticated user has the ability to modify these entries and set the executable path and parameters.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-22

Affected Products (2)

vocera · report_servervulnerable

vocera · voice_servervulnerable

References (4)

https://www.stryker.com/us/en/about/governance/cyber-security/product-security/

Not Applicable

https://www.stryker.com/us/en/about/governance/cyber-security/product-security/vocera-report-server-vulnerabilities--cve-2022-46898--cve-2022-4.html

https://www.stryker.com/us/en/about/governance/cyber-security/product-security/

Not Applicable

https://www.stryker.com/us/en/about/governance/cyber-security/product-security/vocera-report-server-vulnerabilities--cve-2022-46898--cve-2022-4.html

KEV Catalog EPSS Scores Vendors All CVEs