PT-2022-15687 · Sysaid · Sysaid

Published 2022-05-12 · Updated 2023-08-08 · CVE-2022-22798

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sysaid – Pro Plus Edition versions v20.4.74 b10 through v22.1.30 b49

Description The issue allows an attacker to bypass access controls by logging in as a guest and manipulating the URL path to access the system dashboard. The attacker can change the path in the URL to /ConcurrentLogin%2ejsp, receive an error message with a login button, and then connect to the system dashboard by clicking on it. This grants access to sensitive data, including server details, usernames, and workstations. The attacker can also perform actions like uploading files and deleting system calls.

Recommendations For versions v20.4.74 b10 through v22.1.30 b49, consider restricting access to the EndUserPortal.JSP and /ConcurrentLogin%2ejsp endpoints until a patch is available. As a temporary workaround, limit the functionality available to guest users to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2022-22798

Affected Products

Sysaid

References · 4

• https://osv.dev/vulnerability/CVE-2022-22798 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22798 · Security Note
• https://t.me/cibsecurity/42555 · Telegram Post
• https://gov.il/en/departments/faq/cve_advisories · Note