Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in SysAid Technologies Ltd SysAid ausnutzen, um eine SQL Injection durchzuführen oder beliebige Betriebssystemkommandos zu injizieren.
Product
SysAid ist eine IT-Service-Management-(ITSM)-Plattform
Vulnerabilities 2
-
Critical 9.9
SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
-
Critical 9.1
SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Revision history
-
#1
Initiale Fassung
References
-
Israel National Cyber Directorate vom 2024-06-03
https://www.gov.il/en/Departments/faq/cve_advisories
-
NIST Vulnerability Database vom 2024-06-06
https://nvd.nist.gov/vuln/detail/CVE-2024-36393
-
NIST Vulnerability Database vom 2024-06-06
https://nvd.nist.gov/vuln/detail/CVE-2024-36394
-
SysAis Release Notes
https://documentation.sysaid.com/docs/23338