Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control

Description

Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to log in as a guest after that the system redirects him to the service portal or EndUserPortal.JSP, then he needs to change the path in the URL to /ConcurrentLogin%2ejsp after that he will receive an error message with a login button, by clicking on it, he will connect to the system dashboard. The attacker can receive sensitive data like server details, usernames, workstations, etc. He can also perform actions such as uploading files, deleting calls from the system.

Scores

EPSS (exploitation in 30 days)

0.63% · top 50% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.8.

Weakness

• Broken Access Control

Affected products

• SysAid · Sysaid

  • affected 22.1.49 cloud version – ≤ 22.1.49

• SysAid · Sysaid

  • affected 22.1.63 on premise version – ≤ 22.1.63

What to do

Solution: Update to 22.1.50 cloud version, or to 22.1.64 on premise version.

References (1)

• https://www.gov.il/en/departments/faq/cve_advisories (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-22798](https://trackcve.app/badge/CVE-2022-22798.svg)](https://trackcve.app/cve/CVE-2022-22798)

Record last updated 17 Sept 2024, 02:47 UTC.