sysaid on-premises vulnerabilities

Latest sysaid on-premises CVEs

Newest publication first

1. CVE-2023-47246 In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.

   Published 2023-11-10

   Critical·CVSS 9.8 EPSS 98.9% CISA KEV added 2023-11-13 Ransomware Exploited in the wild PoC

   In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.

2. CVE-2023-32226 Sysaid - CWE-552: Files or Directories Accessible to External Parties

   Published 2023-07-30

   Medium·CVSS 6.5 EPSS 0.53%

   Sysaid - CWE-552: Files or Directories Accessible to External Parties - Authenticated users may exfiltrate files from the server via an unspecified method.

3. CVE-2023-32225 Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type

   Published 2023-07-30

   High·CVSS 7.2 EPSS 0.65%

   Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method.

4. CVE-2020-13168 SysAid 20.1.11b26 allows reflected XSS via the ForgotPassword.jsp accountid parameter.

   Published 2020-10-02

   Medium·CVSS 6.1 EPSS 0.97%

   SysAid 20.1.11b26 allows reflected XSS via the ForgotPassword.jsp accountid parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.