PT-2021-18756
CVE-2021-30486
·
تاريخ النشر
2021-07-22
·
تاريخ التحديث
2021-07-31
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
SysAid version 20.3.64 b14
Description
The issue is related to Blind and Stacker SQL injection. It can be exploited via several API endpoints, including "AssetManagementChart.jsp" with
computerID or group1 parameters, "AssetManagementList.jsp" with computerID or group1 parameters, and "AssetManagementSummary.jsp" with the group1 parameter.Recommendations
For SysAid version 20.3.64 b14, consider disabling access to the vulnerable API endpoints, such as "AssetManagementChart.jsp", "AssetManagementList.jsp", and "AssetManagementSummary.jsp", until a patch is available. Restrict the use of the
computerID and group1 parameters in these endpoints to minimize the risk of exploitation.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾