Vulnerability · Published May 12, 2022 · Assigned by INCD

CVE-2022-22797Sysaid – sysaid Open Redirect

Medium 4.6

In plain English

A medium-severity open redirect in Sysaid from SysAid. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)4.6Medium

Exploit odds (30 days)0.5%top 56.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location: /CommunitySSORedirect.jsp?redirectURL=https://google.com. Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.

Affected products (as reported)

Vendor	Product	Versions
SysAid	Sysaid	22.1.49 cloud version – through 22.1.49
SysAid	Sysaid	22.1.63 on premise version – through 22.1.63

Weakness: CWE-601 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://www.gov.il/en/departments/faq/cve_advisories x_refsource_MISC