Vulnerability Description
Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment scenarios allows the attacker to overwrite the configuration, which can be exploited to trigger Remote Code Execution (RCE).
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Orthanc-Server | Orthanc | < 1.12.0 |
Related Weaknesses (CWE)
References
- https://discourse.orthanc-server.org/t/security-advisory-for-orthanc-deploymentsIssue TrackingVendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/09/msg00009.html
- https://www.debian.org/security/2023/dsa-5473
- https://discourse.orthanc-server.org/t/security-advisory-for-orthanc-deploymentsIssue TrackingVendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/09/msg00009.html
- https://www.debian.org/security/2023/dsa-5473
FAQ
What is CVE-2023-33466?
CVE-2023-33466 is a vulnerability with a CVSS score of 8.8 (HIGH). Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment scenarios allows the attacker to overwrite t...
How severe is CVE-2023-33466?
CVE-2023-33466 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-33466?
Check the references section above for vendor advisories and patch information. Affected products include: Orthanc-Server Orthanc.