CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-23165 – Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2022-23165
Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS) - The parameter "helpPageName" used by the page "/help/treecontent.jsp" suffers from a Reflected Cross-Site Scripting vulnerability. For an attacker to exploit this Cross-Site Scripting vulnerability, it's necessary for the affected product to expose the Offline Help Pages. An attacker may gain access to sensitive information or execute client-side code in the browser session of the victim user. Furthermore, an attacker would require the victim to open a malicious link. An attacker may exploit this vulnerability in order to perform phishing attacks. • https://www.gov.il/en/departments/faq/cve_advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2022-22798 – Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control
https://notcve.org/view.php?id=CVE-2022-22798
Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to log in as a guest after that the system redirects him to the service portal or EndUserPortal.JSP, then he needs to change the path in the URL to /ConcurrentLogin%2ejsp after that he will receive an error message with a login button, by clicking on it, he will connect to the system dashboard. The attacker can receive sensitive data like server details, usernames, workstations, etc. He can also perform actions such as uploading files, deleting calls from the system. Sysaid - Pro Plus Edition, SysAid Help Desk Broken Access Control versiones v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - Un atacante necesita iniciar sesión como invitado, después de lo cual el sistema lo redirige al portal de servicios o EndUserPortal.JSP, luego necesita cambiar la ruta en la URL a /ConcurrentLogin%2ejsp, después de lo cual recibirá un mensaje de error con un botón de inicio de sesión, al hacer clic en él, será conectado al tablero del sistema. El atacante puede recibir datos confidenciales como detalles del servidor, nombres de usuario, estaciones de trabajo, etc. • https://www.gov.il/en/departments/faq/cve_advisories •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-22797 – Sysaid – sysaid Open Redirect
https://notcve.org/view.php?id=CVE-2022-22797
Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location: /CommunitySSORedirect.jsp?redirectURL=https://google.com. Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Sysaid - sysaid Redireccionamiento Abierto - Un atacante puede cambiar el enlace de redireccionamiento en el parámetro "redirectURL" de la petición "GET" desde la ubicación de la url: /ComunidadSSORedirect.jsp? • https://www.gov.il/en/departments/faq/cve_advisories • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2022-22796 – Sysaid – Sysaid System Takeover
https://notcve.org/view.php?id=CVE-2022-22796
Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click on the login button, and it will redirect you to /home.jsp without any authentication. Sysaid - Sysaid Toma se Sistema - Un atacante puede omitir el proceso de autenticación accediendo a: /wmiwizard.jsp, Luego a: /ConcurrentLogin.jsp, luego haciendo clic en el botón de inicio de sesión, y le redirigirá a /home.jsp sin ninguna autenticación • https://www.gov.il/en/departments/faq/cve_advisories • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-43973
https://notcve.org/view.php?id=CVE-2021-43973
An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file via the file parameter in the HTTP POST body. A successful request returns the absolute, server-side filesystem path of the uploaded file. Una vulnerabilidad de carga de archivos sin restricciones en el archivo /UploadPsIcon.jsp en SysAid ITIL versión 20.4.74 b10, permite a un atacante remoto autenticado cargar un archivo arbitrario por medio del parámetro file en el cuerpo HTTP POST. Una petición con éxito devuelve la ruta absoluta del sistema de archivos del lado del servidor del archivo cargado • https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.md https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0001.md https://www.sysaid.com/it-service-management-software/incident-management • CWE-434: Unrestricted Upload of File with Dangerous Type •