CVE-2024-33606
11.06.2024, 21:15
An attacker could retrieve sensitive files (medical images) as well as plant new medical images or overwrite existing medical images on a MicroDicom DICOM Viewer system. User interaction is required to exploit this vulnerability.Enginsight
| Vendor | Product | Version |
|---|---|---|
| microdicom | dicom_viewer | 𝑥 < 2024.2 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-939 - Improper Authorization in Handler for Custom URL SchemeThe software uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.
- CWE-862 - Missing AuthorizationThe software does not perform an authorization check when an actor attempts to access a resource or perform an action.