CVE-2025-2776

SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

Sysaid

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

7. Mai 2025

Ausgewertete Quellen

• Hinweis
  https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2776
• CISA
  SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability
• NVD
  CVE-2025-2776