Debian Security Bug TrackerDEBIANCVE:CVE-2023-33466CVE-2023-33466
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.002 Low
EPSS
Percentile
57.9%
Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment scenarios allows the attacker to overwrite the configuration, which can be exploited to trigger Remote Code Execution (RCE).
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 12 | all | orthanc | < 1.10.1+dfsg-2+deb12u1 | orthanc_1.10.1+dfsg-2+deb12u1_all.deb |
| Debian | 11 | all | orthanc | < 1.9.2+really1.9.1+dfsg-1+deb11u1 | orthanc_1.9.2+really1.9.1+dfsg-1+deb11u1_all.deb |
| Debian | 999 | all | orthanc | < 1.12.1+dfsg-1 | orthanc_1.12.1+dfsg-1_all.deb |
| Debian | 13 | all | orthanc | < 1.12.1+dfsg-1 | orthanc_1.12.1+dfsg-1_all.deb |
Related
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.002 Low
EPSS
Percentile
57.9%