title: Sysaid –  Sysaid Local File Inclusion (LFI)
description: Sysaid – Sysaid Local File Inclusion (LFI) – An unauthenticated attacker can access to the system by accessing to "/lib/tinymce/examples/index.html" path. in the "Insert/Edit Embedded Media" window Choose Type : iFrame and File/URL : [here is the LFI] Solution: Update to 22.2.20 cloud version, or to 22.1.64 on premise version.
problem types: Local File Inclusion
affected:
{
platforms: cloud
product: Sysaid
vendor: SysAid
versions:
lessThanOrEqual: 22.2.19, status: affected, version: 22.2.19 cloud version, versionType: custom
}
{
platforms: on premise
product: Sysaid
vendor: SysAid
versions:
lessThanOrEqual: 22.1.63, status: affected, version: 22.1.63 on premise version, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
version: 3.1
]
solutions: Update to 22.2.20 cloud version, or to 22.1.64 on premise version.