CVE-2022-22798 - CVE House
Back to Database
Status published Medium CVE-2022-22798

Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control

Vulnerability Description

Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to log in as a guest after that the system redirects him to the service portal or EndUserPortal.JSP, then he needs to change the path in the URL to /ConcurrentLogin%2ejsp after that he will receive an error message with a login button, by clicking on it, he will connect to the system dashboard. The attacker can receive sensitive data like server details, usernames, workstations, etc. He can also perform actions such as uploading files, deleting calls from the system.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-22798

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Gad Abuhatzeira, Alon Zuker - Sophtix Security LTD

References

More from SysAid

View All →
CVE-2025-2777
SysAid On-Prem <= 23.3.40 lshw Proceessing XML External Entity Injection
Critical 9.3
CVE-2025-2776
SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection
Critical 9.3
CVE-2025-2775
SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection
Critical 9.3
CVE-2024-27775
SysAid - CWE-918: Server-Side Request Forgery (SSRF)
High 7.2
CVE-2022-23166
Sysaid – Sysaid Local File Inclusion (LFI)
Medium 6.1

Affected Vendor

Affected Software

Sysaid
Vulnerable Versions:
22.1.49 cloud version, 22.1.63 on premise version

Timeline

Official Publish: May 12th, 2022
Last Modified: September 17th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.