Back to CVE records
Medium 6.2HealthcarePublished May 14, 2024
CVE-2024-1629Path traversal vulnerability in “deleteFiles” function of Common Service Desktop, a GE HealthCare ultrasound device component
Updated under an hour ago ()
Does this affect you?
It affects GE HealthCare Venue and 15 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.28%, higher than 20% of scored CVEs.
Do this next
Start free and add your stack
Free account, 1 product
Path traversal vulnerability in “deleteFiles” function of Common Service Desktop, a GE HealthCare ultrasound device component
- CVSS
- 6.2 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness (CWE)
- CWE-22
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.28% (percentile 20)
- Assigned by
- GEHC
- NVD analysis
- Deferred
- Record last updated
- Aug 1, 2024
- First seen by InfoSec Signals
- Oct 12, 2026
Affected products
GE HealthCare Venue ge_healthcare:venue (from the name) | R1; R2; from R3 through R3.3; from R4 through R4.3 | CNA record |
GE HealthCare Venue Go ge_healthcare:venue_go (from the name) | R2; from R3 through R3.3; from R4 through R4.3 | CNA record |
GE HealthCare Venue Fit ge_healthcare:venue_fit (from the name) | from R3 through R3.3; from R4 through R4.3 | CNA record |
GE HealthCare LOGIQ e ge_healthcare:logiq_e (from the name) | from R7 through R9.1.4; from R8 through R10.1.3; from R9 through R11.0.3 | CNA record |
GE HealthCare LOGIQ He ge_healthcare:logiq_he (from the name) | through R9.3.1 | CNA record |
GE HealthCare Vivid E ge_healthcare:vivid_e (from the name) | from E95 before 206; from E90 before 206; from E80 before 206 | CNA record |
GE HealthCare Vivid S ge_healthcare:vivid_s (from the name) | from 70N before 206; from 60N before 206 | CNA record |
GE HealthCare Vivid T ge_healthcare:vivid_t (from the name) | from T8 before 206; from T9 before 206 | CNA record |
GE HealthCare Vivid iq ge_healthcare:vivid_iq (from the name) | before 206 | CNA record |
GE HealthCare Voluson Expert 16 ge_healthcare:voluson_expert_16 (from the name) | 0; BT24 | CNA record |
GE HealthCare Voluson Expert 18 ge_healthcare:voluson_expert_18 (from the name) | 0; BT24 | CNA record |
GE HealthCare Voluson Expert 22 ge_healthcare:voluson_expert_22 (from the name) | 0; BT24 | CNA record |
GE HealthCare Voluson SWIFT ge_healthcare:voluson_swift (from the name) | 0; BT24 | CNA record |
GE HealthCare LOGIQ E10 ge_healthcare:logiq_e10 (from the name) | before R3.2.0 | CNA record |
GE HealthCare LOGIQ E10s ge_healthcare:logiq_e10s (from the name) | before R3.2.0 | CNA record |
GE HealthCare LOGIQ Fortis ge_healthcare:logiq_fortis (from the name) | before R3.2.0 | CNA record |
References
- https://securityupdate.gehealthcare.com/
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.