CVE-2023-47246
SysAid Server Path Traversal Vulnerability
Published Nov 9, 2023 · updated Jul 30, 2026 · sysaid sysaid
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.
Timeline
Detection, updates, and resolution for this record.
Nov 9, 2023 · Catalog
Detected
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.
Nov 13, 2023 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Dec 4, 2023 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jul 30, 2026 · Catalog
Updated
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Dec 4, 2023
Affected
- cpe sysaid/sysaidversion unspecified
- vendor SysAid SysAid Serverversion unspecified
Sources
- CISA KEVCVE-2023-47246
SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution.
cisa.gov - CVE.orgCVE-2023-47246
Official CVE identifier
cve.org - FIRST EPSSCVE-2023-47246
30-day exploitation probability 98.9%
first.org - NIST NVDCVE-2023-47246
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.
nvd.nist.gov