An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is Path Traversal via the "restore SQL data" filename. The Vocera Report Console contains a websocket function that allows for the restoration of the database from a ZIP archive that expects a SQL import file. The filename provided is not properly sanitized and allows for the inclusion of a path-traversal payload that can be used to escape the intended Vocera restoration directory. An attacker could exploit this vulnerability to point to a crafted ZIP archive that contains SQL commands that could be executed against the database.
Metrics
Affected Vendors & Products
References
History
Wed, 23 Oct 2024 21:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2023-07-25T00:00:00
Updated: 2024-10-23T20:33:43.638Z
Reserved: 2022-12-09T00:00:00
Link: CVE-2022-46898
Vulnrichment
Updated: 2024-08-03T14:47:27.653Z
NVD
Status : Modified
Published: 2023-07-25T20:15:12.887
Modified: 2024-11-21T07:31:16.027
Link: CVE-2022-46898
Redhat
No data.