Sysaid – Sysaid Local File Inclusion (LFI)
CVE-2022-23166

6.1MEDIUM

Key Information:

Vendor
Sysaid
Status
Sysaid
Vendor
CVE Published:
9 May 2022

Summary

Sysaid – Sysaid Local File Inclusion (LFI) – An unauthenticated attacker can access to the system by accessing to "/lib/tinymce/examples/index.html" path. in the "Insert/Edit Embedded Media" window Choose Type : iFrame and File/URL : [here is the LFI] Solution: Update to 22.2.20 cloud version, or to 22.1.64 on premise version.

Affected Version(s)

Sysaid cloud 22.2.19 cloud version <= 22.2.19

Sysaid on premise 22.1.63 on premise version <= 22.1.63

References

https://www.gov.il/en/departments/faq/cve_advisories
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dudu Moyal - Sophtix Security LTD
.