CVE-2022-22798

Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control

State: Published
Severity: 6.8 Medium
Published: May 12, 2022
Updated: Sep 17, 2024
Reserved: Jan 7, 2022

Description

Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to log in as a guest after that the system redirects him to the service portal or EndUserPortal.JSP, then he needs to change the path in the URL to /ConcurrentLogin%2ejsp after that he will receive an error message with a login button, by clicking on it, he will connect to the system dashboard. The attacker can receive sensitive data like server details, usernames, workstations, etc. He can also perform actions such as uploading files, deleting calls from the system.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L	INCD

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
SysaidSysAid	22.1.49 cloud version through 22.1.49Affected
SysaidSysAid	22.1.63 on premise version through 22.1.63Affected

References

https://www.gov.il/en/departments/faq/cve_advisories

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.