Brand ClaimErleben, was verbindet

Advisory 2023-2437 - SysAid Technologies Ltd SysAid: Vulnerability allows code execution

Notice: You can now also find information from the Vulnerability Advisory Service in the CTI portal!
The CTI portal is available at the following address: https://cti-portal.telekom.net/advisories/2023-2437
Notice: This advisory is by exception shown completely public. You will regularly receive details on vulnerability information as a customer via your login or through our daily advisory e-mail.
5
Attack probability
high
4
Potential damage
medium-high
remote anonymous attackerExploit available
Date
2023-11-10
Release
2023-11-10

Operating System

  • Linux
  • MacOS X
  • Windows

Software

  • SysAid Technologies Ltd SysAid < 23.3.36

Attack

A remote anonymous attacker can exploit a vulnerability in SysAid Technologies Ltd SysAid in order to execute arbitrary code.

Description

SysAid is an IT service management (ITSM) platform

CVE-2023-47246

There is a vulnerability in SysAid Technologies Ltd SysAid. This flaw exists in the on-premise software due to a path traversal issue that allows to write files on the Tomcat webroot. A remote, anonymous attacker can exploit this vulnerability to execute arbitrary code.

CVSSv2 Base Score: 7.5 / Temporal Score: 5.9
AV:N/AC:L/AU:N/C:P/I:P/A:P/E:POC/RL:OF/RC:ND
CVSSv3.1 Base Score: 9.8 / Temporal Score: 8.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:X

According to SysAid, the vulnerability CVE-2023-47246 is already being actively exploited.

Recommendation

SysAid Technologies Ltd provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification

Information

SysAid Blog dated 2023-11-09
https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification

NIST Vulnerability Database dated 2023-11-09
https://nvd.nist.gov/vuln/detail/CVE-2023-47246

References

CVE:CVE-2023-47246

Disclaimer

*The probability of an attack is determined by the attacker's motivation, the necessary expend and the possibilities for an attack. The damage probability is determined by the expend needed to resolute the attack and probable indirect consequences of an attack for business processes. Telekom Security assumes worst case scenarios.

Copyright © 1999-2026 Deutsche Telekom Security GmbH. All rights reserved. Reproduction and distribution of this publication in any form - even in parts - without prior written permission is forbidden.

The information contained herein has been obtained from sources believed to be reliable and trusted or have been verified. Telekom Security can take liability for completeness, accuracy and correctness only in so far, as gross negligence or intention create liability. Any liability beyond it, in particular possible damages resulting from using or non-usability of the information contained herein, is excluded.