« Volver al listado

CVE-2022-22797

Estado: ModificadaMedia (6.1)—

Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location: /CommunitySSORedirect.jsp?redirectURL=https://google.com. Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Sysaid — Sysaid

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-22797",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@cyber.gov.il",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.6,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.5
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@cyber.gov.il",
      "affectedData": [
        {
          "vendor": "SysAid",
          "product": "Sysaid",
          "versions": [
            {
              "status": "affected",
              "version": "22.1.49 cloud version",
              "versionType": "custom",
              "lessThanOrEqual": "22.1.49"
            }
          ],
          "platforms": [
            "cloud"
          ]
        },
        {
          "vendor": "SysAid",
          "product": "Sysaid",
          "versions": [
            {
              "status": "affected",
              "version": "22.1.63 on premise version",
              "versionType": "custom",
              "lessThanOrEqual": "22.1.63"
            }
          ],
          "platforms": [
            "on premise"
          ]
        }
      ]
    }
  ],
  "published": "2022-05-12T20:15:14.913",
  "references": [
    {
      "url": "https://www.gov.il/en/departments/faq/cve_advisories",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cna@cyber.gov.il"
    },
    {
      "url": "https://www.gov.il/en/departments/faq/cve_advisories",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@cyber.gov.il",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter \"redirectURL\" from\"GET\" request from the url location: /CommunitySSORedirect.jsp?redirectURL=https://google.com. Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials."
    },
    {
      "lang": "es",
      "value": "Sysaid - sysaid Redireccionamiento Abierto - Un atacante puede cambiar el enlace de redireccionamiento en el parámetro \"redirectURL\" de la petición \"GET\" desde la ubicación de la url: /ComunidadSSORedirect.jsp?redirectURL=https://google.com. Los redireccionamientos y reenvíos no comprobados son posibles cuando una aplicación web acepta una entrada no confiable que podría causar que la aplicación web redirija la petición a una URL contenida en una entrada no confiable. Al modificar la entrada de la URL no confiable a un sitio malicioso, un atacante puede lanzar con éxito una estafa de phishing y robar las credenciales del usuario"
    }
  ],
  "lastModified": "2026-06-17T04:29:03.810",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sysaid:sysaid:*:*:*:*:cloud:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "702AE9EF-5506-4CFF-BCE4-E6E9C2214644",
              "versionEndExcluding": "22.1.50"
            },
            {
              "criteria": "cpe:2.3:a:sysaid:sysaid:*:*:*:*:on-premises:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2705AD15-BD6F-4F05-8826-894DA3428679",
              "versionEndExcluding": "22.1.64"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@cyber.gov.il"
}