CVE-2022-22797— Sysaid Technologies Sysaid 输入验证错误漏洞

Sysaid – sysaid Open Redirect

Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location: /CommunitySSORedirect.jsp?redirectURL=https://google.com. Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

指向未可信站点的URL重定向(开放重定向)

Sysaid Technologies Sysaid 输入验证错误漏洞

Sysaid Technologies SysAid是以色列Sysaid Technologies公司的一套IT服务管理解决方案。 Sysaid Technologies Sysaid 存在安全漏洞，该漏洞源于程序接受输入缺少验证，可能会发生未经验证的重定向和转发，这可能导致 Web 应用程序将请求重定向到包含在不受信任的输入中的 URL。攻击者通过修改恶意站点的不受信任的 URL 输入，利用该漏洞可能会成功发起网络钓鱼诈骗并窃取用户凭据。

N/A

N/A