CVE-2015-2996
HighSummary
Multiple directory traversal vulnerabilities in SysAid Help Desk before version 15.2 allow remote attackers to read arbitrary files and cause denial of service.
Risk Assessment
Attackers may gain access to sensitive data or cause system overload, leading to service availability interruptions.
Recommendation
It is recommended to upgrade to the latest version of SysAid Help Desk to eliminate these vulnerabilities and monitor the system for unauthorized access attempts.
Other vulnerabilities in SysAid Help Desk
See all- CVE-2015-3000High
SysAid Help Desk versions before 15.2 are vulnerable to an XML Entity Expansion (XEE) attack, allowing remote attackers to cause denial of service through a large number of nested entity references in an XML document.
- CVE-2015-2993High
SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, allowing remote attackers to (1) create administrator accounts via a crafted request to /createnewaccount or (2) write to arbitrary files via the fileName parameter to /userentry.
Original NVD description (English source)
Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the fileName parameter to getGfiUpgradeFile or (2) cause a denial of service (CPU and memory consumption) via a .. (dot dot) in the fileName parameter to calculateRdsFileChecksum.