Vulnerability · Published May 12, 2022 · Assigned by INCD

CVE-2022-22798Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control

Medium 6.8

In plain English

A medium-severity security flaw in Sysaid from SysAid. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.6%top 49.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to log in as a guest after that the system redirects him to the service portal or EndUserPortal.JSP, then he needs to change the path in the URL to /ConcurrentLogin%2ejsp after that he will receive an error message with a login button, by clicking on it, he will connect to the system dashboard. The attacker can receive sensitive data like server details, usernames, workstations, etc. He can also perform actions such as uploading files, deleting calls from the system.

Affected products (as reported)

Vendor	Product	Versions
SysAid	Sysaid	22.1.49 cloud version – through 22.1.49
SysAid	Sysaid	22.1.63 on premise version – through 22.1.63

References

https://www.gov.il/en/departments/faq/cve_advisories x_refsource_MISC