PT-2022-7175
CVE-2022-23166
·
تاريخ النشر
2022-01-11
·
تاريخ التحديث
2022-05-23
الوصف من
CVSS 2.0
10
حرجةالمقاييسAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions
SysAid versions prior to 22.1.64
SysAid versions prior to 22.2.20
Description
The issue is related to an incorrect restriction of a directory path with limited access in the /lib/tinymce/examples/index.html component of the SysAid software. This can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. An unauthenticated attacker can access the system by accessing the "/lib/tinymce/examples/index.html" path in the "Insert/Edit Embedded Media" window by choosing Type: iFrame and File/URL.
Recommendations
Update to version 22.1.64 for on-premise versions.
Update to version 22.2.20 for cloud versions.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾