VulnerabilityModified
CVE-2015-2996
Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to (1) read arbitrary files via a ..
HIGH 8.5EPSS 86.6%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 86.6%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the fileName parameter to getGfiUpgradeFile or (2) cause a denial of service (CPU and memory consumption) via a .. (dot dot) in the fileName parameter to calculateRdsFileChecksum.
- CVSS 2.0
- 8.5 HIGHAV:N/AC:L/Au:N/C:P/I:N/A:C
- EPSS
- 86.64% probability · 100th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- sysaid/sysaid
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.htmlExploit
- http://seclists.org/fulldisclosure/2015/Jun/8Exploit
- http://www.securityfocus.com/archive/1/535679/100/0/threaded
- http://www.securityfocus.com/bid/75038
- https://www.sysaid.com/blog/entry/sysaid-15-2-your-voice-your-service-deskVendor Advisory
- http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.htmlExploit
- http://seclists.org/fulldisclosure/2015/Jun/8Exploit
- http://www.securityfocus.com/archive/1/535679/100/0/threaded
- http://www.securityfocus.com/bid/75038
- https://www.sysaid.com/blog/entry/sysaid-15-2-your-voice-your-service-deskVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.