An unauthenticated vulnerability in the OFFIS DCMTK Toolkit allows unauthorized access to sensitive worklist records, posing a severe risk to data confidentiality.

The vulnerability allows an unauthenticated attacker to perform directory traversal, enabling the unauthorized reading of worklist records from locations outside the intended storage area.

With a CVSS score of 8.2, this vulnerability represents a significant threat to data privacy, particularly in clinical or medical environments where DCMTK is deployed. Unauthorized access to worklist records can result in the leakage of sensitive patient information, leading to regulatory non-compliance and severe reputational impact.

Immediate Action: Apply the latest security patch from the vendor to restrict file access paths and sanitize input parameters.

Proactive Monitoring: Review DICOM server logs for attempts to access non-standard directories or unusual file path traversal characters (e.g., ../).

Compensating Controls: Isolate the DCMTK service within a restricted network segment and implement file system permissions that restrict the service account to only the necessary read/write directories.

Public Exploit Available: false

Given that this vulnerability requires no authentication, the attack surface is significantly expanded. Organizations utilizing the DCMTK Toolkit must prioritize patching to prevent unauthorized data exfiltration and ensure the continued confidentiality of stored medical records.