CVE-2022-23166

Name of the Vulnerable Software and Affected Versions SysAid versions prior to 22.1.64 SysAid versions prior to 22.2.20

Description The issue is related to an incorrect restriction of a directory path with limited access in the /lib/tinymce/examples/index.html component of the SysAid software. This can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. An unauthenticated attacker can access the system by accessing the "/lib/tinymce/examples/index.html" path in the "Insert/Edit Embedded Media" window by choosing Type: iFrame and File/URL.

Recommendations Update to version 22.1.64 for on-premise versions. Update to version 22.2.20 for cloud versions.