// For flags

CVE-2022-23165

Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS)

Severity Score

6.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS) - The parameter "helpPageName" used by the page "/help/treecontent.jsp" suffers from a Reflected Cross-Site Scripting vulnerability. For an attacker to exploit this Cross-Site Scripting vulnerability, it's necessary for the affected product to expose the Offline Help Pages. An attacker may gain access to sensitive information or execute client-side code in the browser session of the victim user. Furthermore, an attacker would require the victim to open a malicious link. An attacker may exploit this vulnerability in order to perform phishing attacks. The attacker can receive sensitive data like server details, usernames, workstations, etc. He can also perform actions such as uploading files, deleting calls from the system

Sysaid - Sysaid versión 14.2.0 Cross-Site Scripting (XSS) Reflejado - El parámetro "helpPageName" usado por la página "/help/treecontent.jsp" sufre una vulnerabilidad de tipo Cross-Site Scripting Reflejado. Para que un atacante pueda explotar esta vulnerabilidad de tipo Cross-Site Scripting, es necesario que el producto afectado exponga las páginas de ayuda sin conexión. Un atacante podría conseguir acceso a información confidencial o ejecutar código del lado del cliente en la sesión del navegador del usuario víctima. Además, un atacante requeriría que la víctima abriera un enlace malicioso. Un atacante puede explotar esta vulnerabilidad para llevar a cabo ataques de phishing. El atacante puede recibir datos confidenciales como detalles del servidor, nombres de usuario, estaciones de trabajo, etc. También puede llevar a cabo acciones como la carga de archivos, la eliminación de llamadas del sistema

*Credits: Robert Catalin Raducioiu,, Francesco Di Castri
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
Low
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-01-11 CVE Reserved
  • 2022-05-12 CVE Published
  • 2023-12-03 EPSS Updated
  • 2024-09-16 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (1)
URL Tag Source
https://www.gov.il/en/departments/faq/cve_advisories Third Party Advisory
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Sysaid
Search vendor "Sysaid"
 Sysaid
Search vendor "Sysaid" for product "Sysaid"
 < 22.1.64
Search vendor "Sysaid" for product "Sysaid" and version " < 22.1.64"
on-premises
Affected
Sysaid
Search vendor "Sysaid"
 Sysaid
Search vendor "Sysaid" for product "Sysaid"
 < 22.2.20
Search vendor "Sysaid" for product "Sysaid" and version " < 22.2.20"
cloud
Affected