Skip to main content

SysAid Releases Security Advisory for Actively Exploited Vulnerability CVE-2023-47246

An exploited zero-day vulnerability which could allow code execution has been discovered affecting SysAid on-prem software

Threat ID:
CC-4406
Threat Severity:
Medium
Published:
9 November 2023 1:27 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

An exploited zero-day vulnerability which could allow code execution has been discovered affecting SysAid on-prem software

Affected platforms

The following platforms are known to be affected:

Versions: all versions prior to 23.3.36

SysAid

Threat details

Introduction

SysAid have released a security advisory addressing a zero day vulnerability affecting the SysAid on-prem software.

This path traversal vulnerability, known as CVE-2023-47246, could allow an attacker to perform code execution within the SysAid on-prem software.

Exploitation of CVE-2023-47246

The vulnerability is known to be exploited in the wild. The threat actor group DEV-0950 (Lace Tempest), have also been observed exploiting this vulnerability.

Remediation advice

Affected organisations are encouraged to review SysAid's security advisory and apply relevant updates.

Last edited: 9 November 2023 1:27 pm