CVE-2023-33466: Code Injection
Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment scenarios allows the attacker to overwrite the configuration, which can be exploited to trigger Remote Code Execution (RCE).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/orthancto a version that resolves this vulnerability.Fixed in 1.5.6+dfsg-1+deb10u1Fixed in 1.9.2+really1.9.1+dfsg-1+deb11u1Fixed in 1.10.1+dfsg-2+deb12u1Fixed in 1.12.1+dfsg-4 - Upgrade
Upgrade
debian/orthancto a version that resolves this vulnerability.Fixed in 1.12.1+dfsg-1Fixed in 1.10.1+dfsg-2+deb12u1Fixed in 1.9.2+really1.9.1+dfsg-1+deb11u1 - Upgrade
Upgrade
Orthancto a version that resolves this vulnerability.Fixed in 1.12.0
Event History
Frequently Asked Questions
What is CVE-2023-33466?
CVE-2023-33466 is a vulnerability in Orthanc server versions before 1.12.0 that allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system and trigger Remote Code Execution (RCE).
What is the severity of CVE-2023-33466?
The severity of CVE-2023-33466 is high with a CVSS score of 8.8.
How can an attacker exploit CVE-2023-33466?
An attacker can exploit CVE-2023-33466 by using authenticated access to the Orthanc API to overwrite arbitrary files on the file system, potentially leading to Remote Code Execution (RCE).
How can I fix CVE-2023-33466?
To fix CVE-2023-33466, update to Orthanc server version 1.12.0 or later.
Where can I find more information about CVE-2023-33466?
For more information about CVE-2023-33466, refer to the following references: [link1], [link2], [link3].