Description (CNA)
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| SysAid / SysAid On-Prem | affected 0 through 23.3.40 |
CWE
CWE-611
References
- https://documentation.sysaid.com/docs/24-40-60
- https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/
ADP enrichment
No English description supplied.