{"api_version":"1","generated_at":"2026-05-13T14:50:12+00:00","cve":"CVE-2022-30277","urls":{"html":"https://cve.report/CVE-2022-30277","api":"https://cve.report/api/cve/CVE-2022-30277.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-30277","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-30277"},"summary":{"title":"CVE-2022-30277","description":"BD Synapsys™, versions 4.20, 4.20 SR1, and 4.30, contain an insufficient session expiration vulnerability. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), protected health information (PHI) and personally identifiable information (PII).","state":"PUBLIC","assigner":"cybersecurity@bd.com","published_at":"2022-06-02 14:15:00","updated_at":"2022-06-10 02:14:00"},"problem_types":["CWE-613"],"metrics":[],"references":[{"url":"https://cybersecurity.bd.com/bulletins-and-patches/bd-synapsys-insufficient-session-expiration","name":"https://cybersecurity.bd.com/bulletins-and-patches/bd-synapsys-insufficient-session-expiration","refsource":"CONFIRM","tags":[],"title":"BD Synapsys<sup>™</sup>– Insufficient Session Expiration","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30277","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30277","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"30277","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"bd","cpe5":"synapsys","cpe6":"4.20","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"30277","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"bd","cpe5":"synapsys","cpe6":"4.20","cpe7":"sr1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"30277","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"bd","cpe5":"synapsys","cpe6":"4.30","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cybersecurity@bd.com","DATE_PUBLIC":"2022-05-31T15:00:00.000Z","ID":"CVE-2022-30277","STATE":"PUBLIC","TITLE":" BD Synapsys™ – Insufficient Session Expiration"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":" BD Synapsys™","version":{"version_data":[{"version_affected":"<=","version_name":"4.20 ","version_value":"4.30"}]}}]},"vendor_name":"Becton Dickinson (BD)"}]}},"configuration":[{"lang":"eng","value":"To exploit this vulnerability, a threat actor would need to gain access to the customer environment and physical access to a BD Synapsys™ workstation.  "}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"BD Synapsys™, versions 4.20, 4.20 SR1, and 4.30, contain an insufficient session expiration vulnerability. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), protected health information (PHI) and personally identifiable information (PII)."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-613 Insufficient Session Expiration"}]}]},"references":{"reference_data":[{"name":"https://cybersecurity.bd.com/bulletins-and-patches/bd-synapsys-insufficient-session-expiration","refsource":"CONFIRM","url":"https://cybersecurity.bd.com/bulletins-and-patches/bd-synapsys-insufficient-session-expiration"}]},"solution":[{"lang":"eng","value":"BD Synapsys™ v4.20 SR2 will be released in June 2022 and will remediate this vulnerability. Customers receiving BD Synapsys™ v4.30 will be allowed to upgrade to v5.10, which is expected to be available by August 2022. "}],"source":{"discovery":"INTERNAL"},"work_around":[{"lang":"eng","value":"Configure the inactivity session timeout in the operating system to match the session expiration timeout in BD Synapsys™.  \n\nEnsure physical access controls are in place and only authorized end-users have access to BD Synapsys™ workstations. \n\nPlace a reminder at each computer for users to logout when leaving the BD Synapsys™ workstation.  \n\nEnsure industry standard network security policies and procedures are followed. "}]},"nvd":{"publishedDate":"2022-06-02 14:15:00","lastModifiedDate":"2022-06-10 02:14:00","problem_types":["CWE-613"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":5.7,"baseSeverity":"MEDIUM"},"exploitabilityScore":0.5,"impactScore":5.2},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:P/A:N","accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":3.6},"severity":"LOW","exploitabilityScore":3.9,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:bd:synapsys:4.30:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:bd:synapsys:4.20:sr1:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:bd:synapsys:4.20:-:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}