CVE-2022-23166

MEDIUM

Sysaid < 22.1.64 and < 22.2.20 - Unauthenticated Local File Inclusion via TinyMCE Embedded Media iFrame

Title source: llm
STIX 2.1

Description

Sysaid – Sysaid Local File Inclusion (LFI) – An unauthenticated attacker can access to the system by accessing to "/lib/tinymce/examples/index.html" path. in the "Insert/Edit Embedded Media" window Choose Type : iFrame and File/URL : [here is the LFI] Solution: Update to 22.2.20 cloud version, or to 22.1.64 on premise version.

References (1)

Core 1
Core References
Third Party Advisory x_refsource_misc
https://www.gov.il/en/departments/faq/cve_advisories

Scores

CVSS v3 6.1
EPSS 0.0101
EPSS Percentile 58.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

Details

CWE
CWE-22
Status published
Products (2)
sysaid/sysaid < 22.1.64
sysaid/sysaid < 22.2.20
Published May 12, 2022
Tracked Since Feb 18, 2026