CRITICAL
OFFIS DCMTK Path Traversal
Published Jun 24, 2022
9.8
CRITICALCVSS 3.1
EPSS 3.29%
Description
OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.
Affected products
-
Affected
- ≥ unspecified, < 3.6.7
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (2)
References (3)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34406 Advisory
- https://lists.debian.org/debian-lts-announce/2025/06/msg00025.html
- https://www.cisa.gov/uscert/ics/advisories/icsma-22-174-01 x_refsource_MISCMitigationThird Party AdvisoryUS Government Resource
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34406 | Advisory | |
| https://lists.debian.org/debian-lts-announce/2025/06/msg00025.html | ||
| https://www.cisa.gov/uscert/ics/advisories/icsma-22-174-01 | x_refsource_MISCMitigationThird Party AdvisoryUS Government Resource |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner icscert
Published Jun 24, 2022
Updated Nov 3, 2025
Reserved Jun 17, 2022
Link CVE-2022-2120
CISA Vulnrichment
Updated Apr 16, 2025
Red Hat
No data
GitHub
No data