CVE-2015-3000
HighSummary
SysAid Help Desk versions before 15.2 are vulnerable to an XML Entity Expansion (XEE) attack, allowing remote attackers to cause denial of service through a large number of nested entity references in an XML document.
Risk Assessment
Attackers can cause high CPU and memory consumption, leading to service unavailability for users.
Recommendation
It is recommended to upgrade SysAid Help Desk to version 15.2 or later to mitigate the risk associated with this vulnerability.
Other vulnerabilities in SysAid Help Desk
See all- CVE-2015-2996High
Multiple directory traversal vulnerabilities in SysAid Help Desk before version 15.2 allow remote attackers to read arbitrary files and cause denial of service.
- CVE-2015-2993High
SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, allowing remote attackers to (1) create administrator accounts via a crafted request to /createnewaccount or (2) write to arbitrary files via the fileName parameter to /userentry.
Original NVD description (English source)
SysAid Help Desk before 15.2 allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an XML document to (1) /agententry, (2) /rdsmonitoringresponse, or (3) /androidactions, aka an XML Entity Expansion (XEE) attack.