CVE-2015-2993

Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2

Description The issue allows remote attackers to create administrator accounts via a crafted request to "/createnewaccount" or write to arbitrary files via the fileName parameter to "/userentry".

Recommendations For versions prior to 15.2, update to version 15.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/createnewaccount" and "/userentry" API endpoints until a patch is available. Avoid using the fileName parameter in the "/userentry" endpoint until the issue is resolved.