CVE-2021-39369

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In Philips (formerly Carestream) Vue MyVue PACS through 12.2.x.x, the VideoStream function allows Path Traversal by authenticated users to access files stored outside of the web root.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01Mitigation, Third Party Advisory, US Government Resource
https://www.usa.philips.com/healthcareVendor Advisory
https://www.youtube.com/watch?v=7zC84TNpIxwProduct
https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01Mitigation, Third Party Advisory, US Government Resource
https://www.usa.philips.com/healthcareVendor Advisory
https://www.youtube.com/watch?v=7zC84TNpIxwProduct

Timeline

Published: Dec 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-393717.5An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assign CVE-2021-393737.8Samsung Drive Manager 2.0.104 on Samsung H3 devices allows attackers to bypass intended access controls on disk management. WideCharToMultiB CVE-2021-393758.8Philips Healthcare Tasy Electronic Medical Record (EMR) 3.06 allows SQL injection via the WAdvancedFilter/getDimensionItemsByCode FilterValu CVE-2021-393768.8Philips Healthcare Tasy Electronic Medical Record (EMR) 3.06 allows SQL injection via the CorCad_F2/executaConsultaEspecifico IE_CORPO_ASSIS CVE-2021-393779.8A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can CVE-2021-393789.8A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can CVE-2021-393799.8A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can CVE-2021-39385.4snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-393839.8DWSurvey v3.2.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /sysuser/SysPropertyAction.java.CVE-2021-393849.8DWSurvey v3.2.0 was discovered to contain an arbitrary file write vulnerability via the component /utils/ToHtmlServlet.java.CVE-2021-39397.8Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable,CVE-2021-393905.4Stored XSS in PartKeepr 1.4.0 Edit section in multiple api endpoints via name parameter.