What is CVE-2022-22798?

CVE-2022-22798 is a medium-severity vulnerability in Sysaid. CVSS score: 6.8/10. Published 2022-05-12.

How severe is CVE-2022-22798?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Vulnerability in Sysaid

CVE-2022-22798

Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to log in as a guest after that the system redirects him to the service portal or EndUserPortal.JSP, then he needs to change the path in the URL to /ConcurrentLogin%2ejsp after that he will receive an error message with a login button, by clicking on it, he will connect to the system dashboard. The attacker can receive sensitive data like server details, usernames, workstations, etc. He can also perform actions such as uploading files, deleting calls from the system.

EPSS: 0.006 (44.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L.

Affected products

Sysaid — versions 22.1.49 cloud version, 22.1.63 on premise version

References

cna@cyber.gov.il (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2022-22798?: CVE-2022-22798 is a medium-severity vulnerability in Sysaid. CVSS score: 6.8/10. Published 2022-05-12.
How severe is CVE-2022-22798?: Medium severity. CVSS v3 base score is 6.8 out of 10.