CVE-2025-2775

CRITICALCISA KEV

9.3

Description

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.

Details CVE

Score CVSS v3.19.3

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie5/7/2025

Derniere modification10/27/2025

Sourcekev

Observations honeypot0

CISA KEV

FournisseurSysAid

ProduitSysAid On-Prem

Nom vulnerabiliteSysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

Date ajout KEV2025-07-22

Date limite remediation2025-08-12

Utilise dans ransomwareUnknown

Produits affectes

sysaid:sysaid

Faiblesses (CWE)

CWE-611

References

https://documentation.sysaid.com/docs/24-40-60(disclosure@vulncheck.com)

https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/(disclosure@vulncheck.com)

https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/(134c704f-9b21-4f2e-91b3-4a467353bcc0)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2775(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.