CVE-2022-22796 - CVE House
Back to Database
Status published High CVE-2022-22796

Sysaid – Sysaid System Takeover

Vulnerability Description

Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click on the login button, and it will redirect you to /home.jsp without any authentication.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-22796

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Dudu Moyal, Gad Abuhatziera, Moriel Harush, Alon Zuker - Sophtix Security LTD

References

More from SysAid

View All →
CVE-2025-2777
SysAid On-Prem <= 23.3.40 lshw Proceessing XML External Entity Injection
Critical 9.3
CVE-2025-2776
SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection
Critical 9.3
CVE-2025-2775
SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection
Critical 9.3
CVE-2024-27775
SysAid - CWE-918: Server-Side Request Forgery (SSRF)
High 7.2
CVE-2022-23166
Sysaid – Sysaid Local File Inclusion (LFI)
Medium 6.1

Affected Vendor

Affected Software

Sysaid
Vulnerable Versions:
21.1.29 cloud version, 21.4.44 on premise version

Timeline

Official Publish: May 12th, 2022
Last Modified: September 17th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.