CVE:CVE-2020-13168
CNNVD:CNNVD-202010-056
SysAid Technologies SysAid是以色列SysAid Technologies公司的一套IT服务管理解决方案。
SysAid Technologies SysAid  20.1.11b26版本存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。
solution:Upgrade sysaid sysaid_on-premises to a higher version than 5.0,5.5.06,5.6,6.0.9,6.5,7.0,7.5,8.0,8.1,8.5,9.0.10,9.0.30,9.0.40,9.0.52,9.0.53,9.1.0,14.1,14.2,14.3,14.4.00,14.4.1,14.4.2,14.4.3,15.1.20,15.1.30,15.1.50,15.1.70,15.2.03,15.2.04,15.2.05,16.3.16,16.3.17,17.2.03,17.3.57,18.1.54,19.2,19.4,and avoid the version 5.0,5.5.06,5.6,6.0.9,6.5,7.0,7.5,8.0,8.1,8.5,9.0.10,9.0.30,9.0.40,9.0.52,9.0.53,9.1.0,14.1,14.2,14.3,14.4.00,14.4.1,14.4.2,14.4.3,15.1.20,15.1.30,15.1.50,15.1.70,15.2.03,15.2.04,15.2.05,16.3.16,16.3.17,17.2.03,17.3.57,18.1.54,19.2,19.4; Upgrade sysaid sysaidsy_on-premises to a higher version than 20.1.11:b26,and avoid the version 20.1.11:b26