Skip to content
OpenAdvisories
High 2 exploited CVEs NCSC-2025-0144 4 CVEs

Kwetsbaarheden verholpen in SysAid On-Prem

Published May 8, 2025 · Updated May 8, 2025 · nl

Vendor: SysAid Product: On-Prem

Summary

SysAid heeft kwetsbaarheden verholpen in SysAid On-Prem (Versies tot 23.3.40)

Details

Interpretaties
De kwetsbaarheid bevindt zich in de ongeauthenticeerde XML External Entity (XXE) die aanwezig is in SysAid On-Prem versies tot 23.3.40. Deze kwetsbaarheid stelt aanvallers in staat om het systeem te exploiteren zonder authenticatie. Dit kan leiden tot ongeautoriseerde toegang tot gevoelige bestanden en de mogelijke overname van administratoraccounts. Onderzoekers hebben Proof-of-Concept-code (PoC) gepubliceerd, waarmee de kwetsbaarheden kunnen worden aangetoond.

Oplossingen
SysAid heeft updates uitgebracht om de kwetsbaarheid te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 4

  • Critical 9.3
    CVE-2025-2775 Exploited Public exploit Scanner template EPSS 43%

    SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection

    SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.

    SysAid SysAid On-Prem
    KEV Jul 22, 2025
  • Critical 9.3
    CVE-2025-2776 Exploited Public exploit Scanner template EPSS 65%

    SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection

    SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

    SysAid SysAid On-Prem
    KEV Jul 22, 2025
  • Critical 9.3
    CVE-2025-2777 Scanner template EPSS 73%

    SysAid On-Prem <= 23.3.40 lshw Proceessing XML External Entity Injection

    SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.

    SysAid SysAid On-Prem
  • Unscored —
    CVE-2025-2778 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Revision history

  1. #1.0.0

    Initiele versie

References