Published: 29/06/2023 Updated: 12/09/2023

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 0

Orthanc prior to 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment scenarios allows the malicious user to overwrite the configuration, which can be exploited to trigger Remote Code Execution (RCE).

Vulnerable Product	Search on Vulmon	Subscribe to Product
orthanc-server orthanc

Debian Bug report logs - #1040597 orthanc: CVE-2023-33466 Package: src:orthanc; Maintainer for src:orthanc is Debian Med Packaging Team <debian-med-packaging@listsaliothdebianorg>; Reported by: Moritz Mühlenhoff <jmm@inutilorg> Date: Fri, 7 Jul 2023 19:00:15 UTC Severity: important Tags: security, upstream ...

It was discovered that authenticated API users of Orthanc, a DICOM server for medical imaging, could overwrite arbitrary files and in some setups execute arbitrary code This update backports the option RestApiWriteToFileSystemEnabled, setting it to true in /etc/orthanc/orthancjson restores the previous behaviour For the oldstable distribution (b ...

NVD-CWE-noinfo https://discourse.orthanc-server.org/t/security-advisory-for-orthanc-deployments-running-versions-before-1-12-0/3568 https://www.debian.org/security/2023/dsa-5473 https://lists.debian.org/debian-lts-announce/2023/09/msg00009.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1040597 https://nvd.nist.gov https://www.debian.org/security/2023/dsa-5473

CVE-2023-33466

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect