CVE-2025-2775

Published May 7, 2025

Last updated 2 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-2775 is an unauthenticated XML External Entity (XXE) vulnerability found in SysAid On-Prem versions 23.3.40 and earlier. This vulnerability exists in the Checkin processing functionality. It could allow an attacker to interfere with the application's parsing of XML input. Successful exploitation of CVE-2025-2775 can lead to administrator account takeover and the ability to read files. This vulnerability, along with CVE-2025-2776 and CVE-2025-2777, can be exploited by sending specially crafted HTTP POST requests to specific endpoints. These vulnerabilities were patched in SysAid On-Prem version 24.4.60 b16.

Description: SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.
Source: disclosure@vulncheck.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.3
Impact score: 4.7
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Severity: CRITICAL

Weaknesses

disclosure@vulncheck.com: CWE-611

Hype score: Not currently trending

References