CVE-2015-3000
SysAid Help Desk 14.4 - Multiple Vulnerabilities
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
SysAid Help Desk before 15.2 allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an XML document to (1) /agententry, (2) /rdsmonitoringresponse, or (3) /androidactions, aka an XML Entity Expansion (XEE) attack.
SysAid Help Desk anterior a 15.2 permite a atacantes remotos causar una denegación de servicio (consumo de CPU y memoria) a través de un número grande de referencias de entidad anidadas en un documento XML en (1) /agententry, (2) /rdsmonitoringresponse, o (3) /androidactions, también conocido como un ataque de la expansión de entidad XML (XEE).
SysAid Help Desk version 14.4 suffers from code execution, denial of service, path disclosure, remote file upload, remote SQL injection, directory traversal, file download, and various other vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-04-07 CVE Reserved
- 2015-06-03 CVE Published
- 2015-06-10 First Exploit
- 2023-03-07 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-399: Resource Management Errors
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/archive/1/535679/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/bid/75038 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.sysaid.com/blog/entry/sysaid-15-2-your-voice-your-service-desk | 2018-10-09 |