Back to CVE Browser

CVE-2023-47246

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2023-11-10

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.

Affected Platforms (CPE)

📦

Sysaid

Sysaid

< 23.3.36

References & Advisories

🔗 https://documentation.sysaid.com/docs/latest-version-installation-files

🔗 https://documentation.sysaid.com/docs/on-premise-security-enhancements-2023

🔗 https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification

🔗 https://documentation.sysaid.com/docs/latest-version-installation-files

🔗 https://documentation.sysaid.com/docs/on-premise-security-enhancements-2023

🔗 https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-47246

Related Vulnerabilities

CVE-2025-27779.3

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw proces...

CVE-2025-27769.3

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL ...

CVE-2025-27759.3

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin pro...

CVE-2024-363949.1

SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')