Vulnerabilities > CVE-2023-33706 - Authorization Bypass Through User-Controlled Key vulnerability in Sysaid

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

sysaid

CWE-639

NVD

Published: 2023-11-24

Updated: 2023-11-30

Summary

SysAid before 23.2.15 allows Indirect Object Reference (IDOR) attacks to read ticket data via a modified sid parameter to EmailHtmlSourceIframe.jsp or a modified srID parameter to ShowMessage.jsp.

Vulnerable Configurations

Part	Description	Count
Application	Sysaid Sysaid Sysaid - Sysaid Sysaid 21.1.30 Sysaid Sysaid 21.1.50 Sysaid Sysaid 22.1.50 Sysaid Sysaid 22.2.20 Sysaid Sysaid 22.3.10 Sysaid Sysaid 22.3.20 Sysaid Sysaid 22.3.30 Sysaid Sysaid 22.3.40 Sysaid Sysaid 22.3.50 Sysaid Sysaid 22.3.60 Sysaid Sysaid 22.3.70 Sysaid Sysaid 22.4.10 Sysaid Sysaid 22.4.20 Sysaid Sysaid 22.4.30 Sysaid Sysaid 22.4.40 Sysaid Sysaid 22.4.50 Sysaid Sysaid 22.4.60 Sysaid Sysaid 23.1.10 Sysaid Sysaid 23.1.20 Sysaid Sysaid 23.1.30 Sysaid Sysaid 23.1.40 Sysaid Sysaid 23.1.50 Sysaid Sysaid 23.1.60 Sysaid Sysaid 23.1.70 Sysaid Sysaid 23.2.10 Sysaid Sysaid 23.2.20 Sysaid Sysaid 23.2.30 Sysaid Sysaid 23.2.40 Sysaid Sysaid 21.4.45 Sysaid Sysaid 22.1.64 Sysaid Sysaid 22.1.65 Sysaid Sysaid 22.3.35 Sysaid Sysaid 22.4.45 Sysaid Sysaid 23.2.14	36

Common Weakness Enumeration (CWE)

CWE-639 - Authorization Bypass Through User-Controlled Key

References

https://blog.pridesec.com.br/en/insecure-direct-object-reference-idor-affects-helpdesk-sysaid/