CVE-2022-30277

lowpriority · track · 23EPSS 0.002 · 14 %ileEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.23% (14th) EPSS

CVSS 3.6 · low

Is it mine?

8 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

BD Synapsys™, versions 4.20, 4.20 SR1, and 4.30, contain an insufficient session expiration vulnerability. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), protected health information (PHI) and personally identifiable information (PII).

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedBD Synapsyscisa_csaf_ot
Additionally, BD recommends the following compensating controls for users working with the impacted versions of BD Synapsys:

cvss

Technical severity, 0–10. One row per scoring source.

5.7

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.6–5.7

v2.03.6lowAV:L/AC:L/Au:N/C:P/I:P/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 4.9

v3.15.7mediumCVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Nprimary · NVD / NIST USexploitability 0.5 · impact 5.2

v3.05.7mediumCVSS:3.0/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Nsecondary · CISA US

v3.15.7mediumAV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.15.7mediumCVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.15.7mediumCVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Nsecondary · cybersecurity@bd.comexploitability 0.5 · impact 5.2

v3.15.2mediumCVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-613USprimaryCWE-613USCWE-613US

affected products (8)

Products and version ranges known to be affected.

BD Synapsys: Versions 4.20 4.20 SR1 and 4.30all versionscisa_csaf_otUS
Becton, Dickinson and Company (BD) BD Synapsysall versionscisa_csaf_otUS
Becton Dickinson (BD) BD Synapsys™≤ 4.20 ≤4.30enisa_euvdEU
Becton Dickinson (BD) BD Synapsys≤ 4.30fstec_bduRU
Becton Dickinson (BD) BD Synapsys≤ 4.20 SR1fstec_bduRU
Becton Dickinson (BD) BD Synapsys≤ 4.20fstec_bduRU
bd synapsys= 4.20nvdUScpe:2.3:a:bd:synapsys:*:*:*:*:*:*:*:*
bd synapsys= 4.30nvdUScpe:2.3:a:bd:synapsys:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

ICSMA-22-151-02BD Synapsys2022-05-31icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to access, modify, or delete sensitive information. This includes electronic protected health information (ePHI), protected health information (PHI), and personally identifiable information (PII).

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot nvd NVD CVE.org MITRE

published 2022-06-02modified 2026-06-17

related (733)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2014-2595US	critical9.8	16.9% (97th)	Exploit	2020-02-12
Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.
CVE-2020-27422US	critical9.8	7.86% (95th)	Exploit	2020-11-16
In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.
CVE-2021-24019US	critical9.8	3.90% (90th)	Exploit	2021-10-06
An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attacker to reuse the unexpired admin user sess…
CVE-2020-29667US	critical9.8	3.23% (88th)	Exploit	2020-12-10
In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSID=LANIT-IMANAGER, can achieve control over the system becaus…
CVE-2017-6529US	high8.8	2.90% (87th)	Exploit	2017-03-09
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter.

+728 more

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan