{"id":"CVE-2024-1629","state":"PUBLISHED","title":"Path traversal vulnerability in “deleteFiles” function of Common Service Desktop, a GE HealthCare ultrasound device component","description":"Path traversal vulnerability in “deleteFiles” function of Common Service Desktop, a GE HealthCare ultrasound device component","publishedAt":"2024-05-14T16:32:43.530Z","updatedAt":"2024-08-01T18:48:21.479Z","severity":{"score":6.2,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"GEHC"},"assigner":"GEHC","products":["GE HealthCare Venue","GE HealthCare Venue Go","GE HealthCare Venue Fit","GE HealthCare LOGIQ e","GE HealthCare LOGIQ He","GE HealthCare Vivid E","GE HealthCare Vivid S","GE HealthCare Vivid T","GE HealthCare Vivid iq","GE HealthCare Voluson Expert 16","GE HealthCare Voluson Expert 18","GE HealthCare Voluson Expert 22","GE HealthCare Voluson SWIFT","GE HealthCare LOGIQ E10","GE HealthCare LOGIQ E10s","GE HealthCare LOGIQ Fortis"],"affected":[{"vendor":"GE HealthCare","product":"Venue","defaultStatus":"unaffected","versions":[{"version":"R1","status":"affected"},{"version":"R2","status":"affected"},{"version":"R3","status":"affected","lessThanOrEqual":"R3.3","versionType":"custom"},{"version":"R4","status":"affected","lessThanOrEqual":"R4.3","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Venue Go","defaultStatus":"unaffected","versions":[{"version":"R2","status":"affected"},{"version":"R3","status":"affected","lessThanOrEqual":"R3.3","versionType":"custom"},{"version":"R4","status":"affected","lessThanOrEqual":"R4.3","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Venue Fit","defaultStatus":"unaffected","versions":[{"version":"R3","status":"affected","lessThanOrEqual":"R3.3","versionType":"custom"},{"version":"R4","status":"affected","lessThanOrEqual":"R4.3","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"LOGIQ e","defaultStatus":"unaffected","versions":[{"version":"R7","status":"affected","lessThanOrEqual":"R9.1.4","versionType":"custom"},{"version":"R8","status":"affected","lessThanOrEqual":"R10.1.3","versionType":"custom"},{"version":"R9","status":"affected","lessThanOrEqual":"R11.0.3","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"LOGIQ He","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"R9.3.1","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Vivid E","defaultStatus":"unaffected","versions":[{"version":"E95","status":"affected","lessThan":"206","versionType":"custom"},{"version":"E90","status":"affected","lessThan":"206","versionType":"custom"},{"version":"E80","status":"affected","lessThan":"206","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Vivid S","defaultStatus":"unaffected","versions":[{"version":"70N","status":"affected","lessThan":"206","versionType":"custom"},{"version":"60N","status":"affected","lessThan":"206","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Vivid T","defaultStatus":"unaffected","versions":[{"version":"T8","status":"affected","lessThan":"206","versionType":"custom"},{"version":"T9","status":"affected","lessThan":"206","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Vivid iq","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"206","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Voluson Expert 16","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"},{"version":"BT24","status":"affected"}]},{"vendor":"GE HealthCare","product":"Voluson Expert 18","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"},{"version":"BT24","status":"affected"}]},{"vendor":"GE HealthCare","product":"Voluson Expert 22","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"},{"version":"BT24","status":"affected"}]},{"vendor":"GE HealthCare","product":"Voluson SWIFT","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"},{"version":"BT24","status":"affected"}]},{"vendor":"GE HealthCare","product":"LOGIQ E10","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"R3.2.0","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"LOGIQ E10s","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"R3.2.0","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"LOGIQ Fortis","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"R3.2.0","versionType":"custom"}]}],"references":["https://securityupdate.gehealthcare.com/"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/1xxx/CVE-2024-1629.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-1629","state":"PUBLISHED","datePublished":"2024-05-14T16:32:43.530Z","dateUpdated":"2024-08-01T18:48:21.479Z","assignerShortName":"GEHC","assignerOrgId":"171caf72-b841-4e04-a68e-93493aff2b94","dateReserved":"2024-02-19T15:23:21.436Z"},"containers":{"cna":{"title":"Path traversal vulnerability in “deleteFiles” function of Common Service Desktop, a GE HealthCare ultrasound device component","descriptions":[{"lang":"en","value":"Path traversal vulnerability in “deleteFiles” function of Common Service Desktop, a GE HealthCare ultrasound device component"}],"affected":[{"vendor":"GE HealthCare","product":"Venue","defaultStatus":"unaffected","versions":[{"version":"R1","status":"affected"},{"version":"R2","status":"affected"},{"version":"R3","status":"affected","lessThanOrEqual":"R3.3","versionType":"custom"},{"version":"R4","status":"affected","lessThanOrEqual":"R4.3","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Venue Go","defaultStatus":"unaffected","versions":[{"version":"R2","status":"affected"},{"version":"R3","status":"affected","lessThanOrEqual":"R3.3","versionType":"custom"},{"version":"R4","status":"affected","lessThanOrEqual":"R4.3","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Venue Fit","defaultStatus":"unaffected","versions":[{"version":"R3","status":"affected","lessThanOrEqual":"R3.3","versionType":"custom"},{"version":"R4","status":"affected","lessThanOrEqual":"R4.3","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"LOGIQ e","defaultStatus":"unaffected","versions":[{"version":"R7","status":"affected","lessThanOrEqual":"R9.1.4","versionType":"custom"},{"version":"R8","status":"affected","lessThanOrEqual":"R10.1.3","versionType":"custom"},{"version":"R9","status":"affected","lessThanOrEqual":"R11.0.3","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"LOGIQ He","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"R9.3.1","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Vivid E","defaultStatus":"unaffected","versions":[{"version":"E95","status":"affected","lessThan":"206","versionType":"custom"},{"version":"E90","status":"affected","lessThan":"206","versionType":"custom"},{"version":"E80","status":"affected","lessThan":"206","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Vivid S","defaultStatus":"unaffected","versions":[{"version":"70N","status":"affected","lessThan":"206","versionType":"custom"},{"version":"60N","status":"affected","lessThan":"206","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Vivid T","defaultStatus":"unaffected","versions":[{"version":"T8","status":"affected","lessThan":"206","versionType":"custom"},{"version":"T9","status":"affected","lessThan":"206","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Vivid iq","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"206","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Voluson Expert 16","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"},{"version":"BT24","status":"affected"}]},{"vendor":"GE HealthCare","product":"Voluson Expert 18","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"},{"version":"BT24","status":"affected"}]},{"vendor":"GE HealthCare","product":"Voluson Expert 22","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"},{"version":"BT24","status":"affected"}]},{"vendor":"GE HealthCare","product":"Voluson SWIFT","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"},{"version":"BT24","status":"affected"}]},{"vendor":"GE HealthCare","product":"LOGIQ E10","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"R3.2.0","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"LOGIQ E10s","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"R3.2.0","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"LOGIQ Fortis","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"R3.2.0","versionType":"custom"}]}],"references":[{"url":"https://securityupdate.gehealthcare.com/"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"GEHC","orgId":"171caf72-b841-4e04-a68e-93493aff2b94","dateUpdated":"2024-05-14T16:32:43.530Z"},"credits":[{"lang":"en","type":"finder","value":"Andrea Palanca and Gabriele Quagliarella of Nozomi Networks"}],"impacts":[{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126 Path Traversal"}]}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-1629","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-05-16T16:09:37.900864Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T18:01:09.761Z"}},{"title":"CVE Program Container","references":[{"url":"https://securityupdate.gehealthcare.com/","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T18:48:21.479Z"}}]}}}