CVE-2024-27775

SysAid - CWE-918: Server-Side Request Forgery (SSRF)

View on CVE.org

Published Mar 28, 2024 CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Description

SysAid before version 23.2.14 b18 - CWE-918: Server-Side Request Forgery (SSRF) may allow exposing the local OS user's NTLMv2 hash

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

SysAid

SysAid

unaffected

Version	Status	Constraints
`version 23.2.14 b18`	affected	≤ Upgrade to version 23.3.38 or later

No data.

No data.

Vendor	Product	Versions
Sysaid	Sysaid	—

Remediation

Vendor Solution

Upgrade to version 23.3.38 or later

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2024-24968	SysAid before version 23.2.14 b18 - CWE-918: Server-Side Request Forgery (SSRF) may allow exposing the local OS user's NTLMv2 hash

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.583% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://www.gov.il/en/Departments/faq/cve_advisories

History

No history.

Subscriptions

Sysaid Sysaid

Weaknesses

CWE-918

Sources

CVE record Updated: Aug 2, 2024, 12:41 AM

Status: PUBLISHED
Assigner: INCD
Published: Mar 28, 2024, 12:19 PM
Updated: Aug 2, 2024, 12:41 AM
Reserved: Feb 26, 2024, 9:27 AM

View source JSON

Vulnrichment Updated: Aug 2, 2024, 12:41 AM

Updated: Aug 2, 2024, 12:41 AM

NVD Updated: Jun 17, 2026, 7:20 AM

Status: Deferred
Published: Mar 28, 2024, 1:15 PM
Modified: Jun 17, 2026, 7:20 AM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment Updated: Jul 13, 2025, 11:21 AM

Updated: Jul 13, 2025, 11:21 AM

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-27775", "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "state": "PUBLISHED", "assignerShortName": "INCD", "dateReserved": "2024-02-26T09:27:55.323Z", "datePublished": "2024-03-28T12:19:53.385Z", "dateUpdated": "2024-08-02T00:41:54.967Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SysAid", "vendor": "SysAid", "versions": [{"lessThanOrEqual": "Upgrade to version 23.3.38 or later", "status": "affected", "version": "version 23.2.14 b18", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Niv Levy"}], "datePublic": "2024-03-28T12:18:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">SysAid before version 23.2.14 b18 - <span style=\"background-color: rgb(255, 255, 255);\">CWE-918: Server-Side Request Forgery (SSRF) may allow exposing the local OS user's NTLMv2 hash</span>\n\n</span>"}], "value": "\nSysAid before version 23.2.14 b18 -\u00a0CWE-918: Server-Side Request Forgery (SSRF) may allow exposing the local OS user's NTLMv2 hash\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "shortName": "INCD", "dateUpdated": "2024-03-28T12:19:53.385Z"}, "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">Upgrade to version 23.3.38 or later</span>\n\n<br>"}], "value": "\nUpgrade to version 23.3.38 or later\n\n"}], "source": {"advisory": "ILVN-2024-0155", "discovery": "UNKNOWN"}, "title": "SysAid - CWE-918: Server-Side Request Forgery (SSRF)", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-27775", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-10T19:45:47.358316Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:47:20.997Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:41:54.967Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:41:54.967Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-27775", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-10T19:45:47.358316Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:23.124Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "SysAid - CWE-918: Server-Side Request Forgery (SSRF)", "source": {"advisory": "ILVN-2024-0155", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Niv Levy"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SysAid", "product": "SysAid", "versions": [{"status": "affected", "version": "version 23.2.14 b18", "versionType": "custom", "lessThanOrEqual": "Upgrade to version 23.3.38 or later"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "\nUpgrade to version 23.3.38 or later\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">Upgrade to version 23.3.38 or later</span>\n\n<br>", "base64": false}]}], "datePublic": "2024-03-28T12:18:00.000Z", "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\nSysAid before version 23.2.14 b18 -\u00a0CWE-918: Server-Side Request Forgery (SSRF) may allow exposing the local OS user's NTLMv2 hash\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">SysAid before version 23.2.14 b18 - <span style=\"background-color: rgb(255, 255, 255);\">CWE-918: Server-Side Request Forgery (SSRF) may allow exposing the local OS user's NTLMv2 hash</span>\n\n</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "shortName": "INCD", "dateUpdated": "2024-03-28T12:19:53.385Z"}}}, "cveMetadata": {"cveId": "CVE-2024-27775", "state": "PUBLISHED", "dateUpdated": "2024-08-02T00:41:54.967Z", "dateReserved": "2024-02-26T09:27:55.323Z", "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f", "datePublished": "2024-03-28T12:19:53.385Z", "assignerShortName": "INCD"}, "dataVersion": "5.1"}