CVE-2022-46902

Summary

CVE-2022-46902 is a path traversal vulnerability affecting Vocera Report Server and Voice Server 5.x through 5.8. The issue lies in the Vocera Report Console's websocket function, which restores the database from a ZIP archive. During the unzip operation, the code accepts file paths from the archive but fails to validate them effectively, allowing for potential directory traversal payloads. As a result, the intended destination of the unzip operation may be bypassed, posing a security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.