Back to CVE records
High 7.7HealthcarePublished May 14, 2024
CVE-2024-1630Path traversal vulnerability in “getAllFolderContents” function of Common Service Desktop, a GE HealthCare ultrasound device component
Updated under an hour ago ()
Does this affect you?
It affects GE HealthCare Venue and 29 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.28%, higher than 20% of scored CVEs.
Do this next
Start free and add your stack
Free account, 1 product
Path traversal vulnerability in “getAllFolderContents” function of Common Service Desktop, a GE HealthCare ultrasound device component
- CVSS
- 7.7 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weakness (CWE)
- CWE-22
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.28% (percentile 20)
- Assigned by
- GEHC
- NVD analysis
- Deferred
- Record last updated
- Aug 22, 2024
- First seen by InfoSec Signals
- Oct 12, 2026
Affected products
GE HealthCare Venue ge_healthcare:venue (from the name) | R1; R2; from R3 through R3.3; from R4 through R4.3 | CNA record |
GE HealthCare Venue Go ge_healthcare:venue_go (from the name) | R2; from R3 through R3.3; from R4 through R4.3 | CNA record |
GE HealthCare Venue Fit ge_healthcare:venue_fit (from the name) | from R3 through R3.3; from R4 through R4.3 | CNA record |
GE HealthCare LOGIQ e ge_healthcare:logiq_e (from the name) | from R7 through R9.1.4; from R8 through R10.1.3; from R9 through R11.0.3 | CNA record |
GE HealthCare LOGIQ He ge_healthcare:logiq_he (from the name) | through R9.3.1 | CNA record |
GE HealthCare Vivid E ge_healthcare:vivid_e (from the name) | from E95 before 206; from E90 before 206; from E80 before 206 | CNA record |
GE HealthCare Vivid T ge_healthcare:vivid_t (from the name) | from T8 before 206; from T9 before 206 | CNA record |
GE HealthCare Vivid iq ge_healthcare:vivid_iq (from the name) | before 206 | CNA record |
GE HealthCare Voluson Expert 16 ge_healthcare:voluson_expert_16 (from the name) | 0; BT24 | CNA record |
GE HealthCare Voluson Expert 18 ge_healthcare:voluson_expert_18 (from the name) | 0; BT24 | CNA record |
GE HealthCare Voluson Expert 22 ge_healthcare:voluson_expert_22 (from the name) | 0; BT24 | CNA record |
GE HealthCare Voluson SWIFT ge_healthcare:voluson_swift (from the name) | 0; BT24 | CNA record |
GE HealthCare LOGIQ E10 ge_healthcare:logiq_e10 (from the name) | before R3.2.0 | CNA record |
GE HealthCare LOGIQ E10s ge_healthcare:logiq_e10s (from the name) | before R3.2.0 | CNA record |
GE HealthCare LOGIQ Fortis ge_healthcare:logiq_fortis (from the name) | before R3.2.0 | CNA record |
gehealthcare venue_firmware gehealthcare:venue_firmware | r1; r2; from r3 through r3.3; from r4 through r4.3 | CISA ADP |
gehealthcare venue_go_firmware gehealthcare:venue_go_firmware | r2; from r3 through r3.3; from r4 through r4.3 | CISA ADP |
gehealthcare venue_fit_firmware gehealthcare:venue_fit_firmware | from r3 through r3.3; from r4 through r4.3 | CISA ADP |
gehealthcare logiq_e_firmware gehealthcare:logiq_e_firmware | from r7 through r9.1.4; from r8 through r10.1.3; from r9 through r11.0.3 | CISA ADP |
gehealthcare logiq_he_firmware gehealthcare:logiq_he_firmware | through r9.3.1 | CISA ADP |
gehealthcare vivid_e_firmware gehealthcare:vivid_e_firmware | from e95 before 206; from e90 before 206; from e80 before 206 | CISA ADP |
gehealthcare vivid_t_firmware gehealthcare:vivid_t_firmware | from t8 before 206; from t9 before 206 | CISA ADP |
gehealthcare vivid_iq_firmware gehealthcare:vivid_iq_firmware | before 206 | CISA ADP |
gehealthcare voluson_expert_16 gehealthcare:voluson_expert_16 | 0; bt24 | CISA ADP |
gehealthcare voluson_expert_18 gehealthcare:voluson_expert_18 | 0; bt24 | CISA ADP |
gehealthcare voluson_expert_22 gehealthcare:voluson_expert_22 | 0; bt24 | CISA ADP |
gehealthcare voluson_swift gehealthcare:voluson_swift | 0; bt24 | CISA ADP |
gehealthcare logiq_e10 gehealthcare:logiq_e10 | before r3.2.0 | CISA ADP |
gehealthcare logiq_e10s gehealthcare:logiq_e10s | before r3.2.0 | CISA ADP |
gehealthcare logiq_fortis gehealthcare:logiq_fortis | before r3.2.0 | CISA ADP |
References
- https://securityupdate.gehealthcare.com/
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.