Lucene search

[email protected]CVE-2024-1863

HistoryApr 01, 2024 - 10:15 p.m.

CVE-2024-1863

2024-04-0122:15:12

CWE-89

[email protected]

web.nvd.nist.gov

sante pacs server

token endpoint

sql injection

remote code execution

network service

vulnerability

http requests

port 3000

zdi-can-21539

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

29.0%

JSON

Sante PACS Server Token Endpoint SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante PACS Server. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the processing of HTTP requests on port 3000. When parsing the token parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-21539.

Affected configurations

Vulners

Node

santepacs_serverRange≤3.3.3

CNA Affected

[
  {
    "vendor": "Sante",
    "product": "PACS Server",
    "versions": [
      {
        "version": "3.3.3",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

www.zerodayinitiative.com/advisories/ZDI-24-193/

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

29.0%

JSON

Related for CVE-2024-1863

cvelist1 nvd1 zdi1