CVE-2022-22796 - Sysaid – Sysaid System Takeover

Back Back to CVE browser

CRITICAL

Sysaid – Sysaid System Takeover

Published May 12, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 1.42%

Description

Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click on the login button, and it will redirect you to /home.jsp without any authentication.

Affected products

Vendor SysAid Product Sysaid Default
n/a
- Version
  21.1.29 cloud version
  Status
  affected
  Constraints
  <=21.1.29
- Version
  21.4.44 on premise version
  Status
  affected
  Constraints
  <=21.4.44

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SysAid

Sysaid

n/a

Version	Status	Constraints
21.1.29 cloud version	affected	<=21.1.29
21.4.44 on premise version	affected	<=21.4.44

Remediation

Vendor solution

Update to 21.1.30 cloud version, or to 21.4.45 on premise version.

Weaknesses (1)

CWE-287

Improper Authentication

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-27939
Advisory
https://www.gov.il/en/departments/faq/cve_advisories
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-27939		Advisory
https://www.gov.il/en/departments/faq/cve_advisories		x_refsource_MISCThird Party Advisory