CVE-2022-2120: OFFIS DCMTK Path Traversal
Published Jun 24, 2022
·Updated
Last updated 24 July 2024
Other sources
OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.
Affected Software
2 affected componentsFixes available
debian/dcmtk<=3.6.5-1
3.6.7-9~deb12u13.6.8-6
OFFIS DCMTK<3.6.7
Event History
Jun 24, 2022
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeaknessAffected Software
Sep 21, 2024
Data Sourced
via Ubuntu·10:11 AM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·10:12 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2022-2120?
CVE-2022-2120 is classified as a high severity vulnerability due to its potential for remote code execution.
2
How do I fix CVE-2022-2120?
To fix CVE-2022-2120, upgrade to OFFIS DCMTK version 3.6.7 or later.
3
What type of vulnerability is CVE-2022-2120?
CVE-2022-2120 is a relative path traversal vulnerability that allows unauthorized file writing.
4
Which versions of OFFIS DCMTK are affected by CVE-2022-2120?
All versions of OFFIS DCMTK prior to 3.6.7 are affected by CVE-2022-2120.
5
Can CVE-2022-2120 lead to data compromise?
Yes, CVE-2022-2120 can potentially lead to data compromise through unauthorized writing of DICOM files.