PT-2022-15685 · Sysaid · Sysaid

Published 2022-01-11 · Updated 2022-05-23 · CVE-2022-22796

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sysaid (affected versions not specified)

Description The issue allows an attacker to bypass the authentication process. This can be achieved by accessing the "/wmiwizard.jsp" API endpoint, then navigating to the "/ConcurrentLogin.jsp" endpoint, clicking on the login button, which redirects to the "/home.jsp" endpoint without requiring any authentication.

Recommendations As a temporary workaround, consider restricting access to the "/wmiwizard.jsp", "/ConcurrentLogin.jsp", and "/home.jsp" API endpoints until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Path traversal

Weakness Enumeration

CWE-287

CWE-22

CWE-73

Related Identifiers

BDU:2023-08591

CVE-2022-22796

Affected Products

Sysaid

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-22796 · Security Note
• https://bdu.fstec.ru/vul/2023-08591 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22796 · Vendor Advisory
• https://t.me/cibsecurity/42564 · Telegram Post
• https://vuldb.com/ru/?id.199807 · Note
• https://community.sysaid.com/help-desk-16/cve-2022-22796-and-cve-2022-23166-fix-availability-12696 · Note
• https://gov.il/en/departments/faq/cve_advisories · Note