An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is Arbitrary File Upload. The BaseController class, that each of the service controllers derives from, allows for the upload of arbitrary files. If the HTTP request is a multipart/form-data POST request, any parameters with a filename entry will have their content written to a file in the Vocera upload-staging directory with the specified filename in the parameter.
Metrics
Affected Vendors & Products
References
History
Wed, 23 Oct 2024 21:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2023-07-25T00:00:00
Updated: 2024-10-23T20:33:11.455Z
Reserved: 2022-12-09T00:00:00
Link: CVE-2022-46899
Vulnrichment
Updated: 2024-08-03T14:47:27.718Z
NVD
Status : Modified
Published: 2023-07-25T20:15:12.997
Modified: 2024-11-21T07:31:16.207
Link: CVE-2022-46899
Redhat
No data.