Medium severity · published Dec 26, 2022
CVE-2021-39369
In Philips (formerly Carestream) Vue MyVue PACS through 12.2.x.x, the VideoStream function allows Path Traversal by authenticated users to access files stored outside of the web…
6.5
CVSS
0.9%
EPSS
No
On KEV
Description
In Philips (formerly Carestream) Vue MyVue PACS through 12.2.x.x, the VideoStream function allows Path Traversal by authenticated users to access files stored outside of the web root.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MY
Myvue · Philips
All versions, or not specified · source: NVD
SP
Speech · Philips
All versions, or not specified · source: NVD
VM
Vue Motion · Philips
through 12.2.1.5 · source: NVD
VP
Vue Pacs · Philips
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-39369
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-39369
Mitigation
https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01
Vendor Advisory
https://www.usa.philips.com/healthcare
Product
https://www.youtube.com/watch?v=7zC84TNpIxw
More from Myvue
9.8
CVE-2021-27501
Philips Vue PACS versions 12.2.x.x and prior does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the…
9.8
CVE-2021-27497
Philips Vue PACS versions 12.2.x.x and prior does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product
7.5
CVE-2021-33024
Philips Vue PACS versions 12.2.x.x and prior transmits or stores authentication credentials, but it uses an insecure method susceptible to unauthorized interception and/or…
7.5
CVE-2021-33022
Philips Vue PACS versions 12.2.x.x and prior transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors
7.5
CVE-2021-33020
Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing…