VDB
CVE-2022-2119
CVE-2022-2119
PUBLISHED
CVSS 7.5 HIGH
OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.
EPSS 3.37% · 88.7th percentile
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
3.37%
88.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| offis | dcmtk | 0 |
| OFFIS | DCMTK | unspecified |
Timeline
- Jun 24, 2022 CVE Published
- Jun 25, 2022 EPSS Score
- Jul 5, 2022 CVE Updated
- Aug 13, 2022 EPSS Score
- Sep 30, 2022 EPSS Score
- Jan 5, 2023 EPSS Score
- Feb 22, 2023 EPSS Score
- Apr 11, 2023 EPSS Score
- Jul 16, 2023 EPSS Score
- Sep 3, 2023 EPSS Score
- Dec 8, 2023 EPSS Score
- Jan 25, 2024 EPSS Score