title: Sysaid – Sysaid System Takeover
description: Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click on the login button, and it will redirect you to /home.jsp without any authentication.
problem types: System Take Over
affected:
{
platforms: cloud
product: Sysaid
vendor: SysAid
versions:
lessThanOrEqual: 21.1.29, status: affected, version: 21.1.29 cloud version, versionType: custom
}
{
platforms: on premise
product: Sysaid
vendor: SysAid
versions:
lessThanOrEqual: 21.4.44, status: affected, version: 21.4.44 on premise version, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
version: 3.1
]
solutions: Update to 21.1.30 cloud version, or to 21.4.45 on premise version.