CWE-918: Server-Side Request Forgery (SSRF) may allow exposing the local OS user's NTLMv2 hash

CVE-2024-27775

What is CVE-2024-27775?

A Server-Side Request Forgery (SSRF) vulnerability has been identified in SysAid software versions prior to 23.2.14 b18. This vulnerability allows attackers to manipulate requests sent from the server to access unauthorized resources. As a result, an attacker could exploit this weakness to expose sensitive information, including the local OS user's NTLMv2 hash, potentially leading to further attacks on the system's security. Organizations utilizing affected versions should prioritize updating their systems to avoid such risks.

References