SysAid · SysAid On-Prem
CVE-2025-2776
SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection
O que é
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.
CISA: SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.
O que fazer
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Prazo para as agências federais dos EUA: 12 de agosto de 2025
Mais falhas exploradas de SysAid
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 22 de jul. de 2025 | On-Prem Improper Restriction of XML External Entity Reference | SysAid On-Prem | Crítica 9,3 | 43% |
| 13 de nov. de 2023 | Server Path Traversal | SysAid Server | Crítica 9,8 | 99% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.