CVE-2021-43972

 

Published at: - 11-01-2022 09:15

Last modified: - 20-01-2022 06:08

Total changes: - 3

Description

An unrestricted file copy vulnerability in /UserSelfServiceSettings.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to copy arbitrary files on the server filesystem to the web root (with an arbitrary filename) via the tempFile and fileName parameters in the HTTP POST body.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

 

Verification logic

 

Reference

• https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.md
• https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0001.md
• https://www.sysaid.com/it-service-management-software/incident-management

 

Keywords

NVD

 

CVE-2021-43972

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures