Anonymous User Registration Bypass in SysAid ITIL by SysAid

CVE-2021-43974

What is CVE-2021-43974?

A security flaw exists in SysAid ITIL 20.4.74 b10 that allows unauthenticated users to register for new accounts. The /enduserreg endpoint fails to adhere to server-side configurations that restrict anonymous user registration. In instances where the server setting is adjusted to disable anonymous registrations, only the client-side form is concealed. Unscrupulous users can still submit registration data, thereby creating accounts without proper authentication, posing potential risks to the integrity of the system.

References