An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is Arbitrary File Upload. The BaseController class, that each of the service controllers derives from, allows for the upload of arbitrary files. If the HTTP request is a multipart/form-data POST request, any parameters with a filename entry will have their content written to a file in the Vocera upload-staging directory with the specified filename in the parameter.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2023-07-25T00:00:00
Updated: 2024-08-03T14:47:27.718Z
Reserved: 2022-12-09T00:00:00
Link: CVE-2022-46899
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2023-07-25T20:15:12.997
Modified: 2023-08-01T01:28:42.690
Link: CVE-2022-46899
Redhat
No data.