PT-2022-7175 · Sysaid · Sysaid

Published 2022-01-11 · Updated 2022-05-23 · CVE-2022-23166

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SysAid versions prior to 22.1.64 SysAid versions prior to 22.2.20

Description The issue is related to an incorrect restriction of a directory path with limited access in the /lib/tinymce/examples/index.html component of the SysAid software. This can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. An unauthenticated attacker can access the system by accessing the "/lib/tinymce/examples/index.html" path in the "Insert/Edit Embedded Media" window by choosing Type: iFrame and File/URL.

Recommendations Update to version 22.1.64 for on-premise versions. Update to version 22.2.20 for cloud versions.

Fix

Path traversal

Weakness Enumeration

CWE-73

CWE-22

Related Identifiers

BDU:2023-08591

CVE-2022-23166

Affected Products

Sysaid

References · 8

• https://osv.dev/vulnerability/CVE-2022-23166 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23166 · Security Note
• https://bdu.fstec.ru/vul/2023-08591 · Security Note
• https://t.me/cvenotify/30588 · Telegram Post
• https://vuldb.com/ru/?id.199807 · Note
• https://community.sysaid.com/help-desk-16/cve-2022-22796-and-cve-2022-23166-fix-availability-12696 · Note
• https://t.me/cibsecurity/42565 · Telegram Post
• https://gov.il/en/departments/faq/cve_advisories · Note