WID-SEC-W-2024-1306

DeutschShown in its original language — a full translation is planned for a future version.

SysAid: Mehrere Schwachstellen

view advisory published 2024-06-05

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in SysAid Technologies Ltd SysAid ausnutzen, um eine SQL Injection durchzuführen oder beliebige Betriebssystemkommandos zu injizieren.

describes (2)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-36394US	critical9.8	1.10% (66th)	—	2024-06-06
SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-36393US	critical9.8	0.42% (36th)	—	2024-06-06
SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

references

External citations — patches, advisories, analysis.

SysAis Release Notesexternal
NIST Vulnerability Database vom 2024-06-06external
NIST Vulnerability Database vom 2024-06-06external
WID-SEC-W-2024-1306 - CSAF Versionself
WID-SEC-2024-1306 - Portal Versionself
Israel National Cyber Directorate vom 2024-06-03external

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan