Unauthenticated Directory Traversal in Worklist Storage

Executive Summary

This vulnerability allows an unauthenticated attacker to read worklist records from a directory that is outside the intended storage area for each Application Entity (AE).

In environments where multiple areas or departments are deployed, this flaw can lead to unauthorized access crossing departmental or clinic data boundaries.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive worklist records, potentially exposing confidential information across different departments or clinics.

Since the attacker does not need to be authenticated, this increases the risk of data breaches and unauthorized data access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an unauthenticated attacker to read worklist records from directories outside the intended storage area, potentially crossing departmental or clinic data boundaries in multi-area deployments.

Such unauthorized access to sensitive data could lead to violations of data protection regulations and standards like GDPR and HIPAA, which mandate strict controls on access to personal and health information.

Therefore, this vulnerability may compromise compliance by exposing protected data to unauthorized parties, undermining confidentiality and data segregation requirements.

Useful 0 Not Useful 0