CVE-2022-22796

HIGH

SysAid < 21.1.30 and < 21.4.45 - Unauthenticated Authentication Bypass via wmiwizard.jsp

Title source: llm
STIX 2.1

Description

Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click on the login button, and it will redirect you to /home.jsp without any authentication.

References (1)

Core 1
Core References
Third Party Advisory x_refsource_misc
https://www.gov.il/en/departments/faq/cve_advisories

Scores

CVSS v3 7.0
EPSS 0.0126
EPSS Percentile 65.8%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Details

CWE
CWE-287
Status published
Products (2)
sysaid/sysaid < 21.1.30
sysaid/sysaid < 21.4.45
Published May 12, 2022
Tracked Since Feb 18, 2026