An issue was discovered in SysAid ITIL 20.4.74 b10. The /enduserreg endpoint is used to register end users anonymously, but does not respect the server-side setting that determines if anonymous users are allowed to register new accounts. Configuring the server-side setting to disable anonymous user registration only hides the client-side registration form. An attacker can still post registration data to create new accounts without prior authentication.
References
| Link | Resource |
|---|---|
| https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.md | Broken Link Third Party Advisory |
| https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0001.md | Exploit Third Party Advisory |
| https://www.sysaid.com/it-service-management-software/incident-management | Vendor Advisory |
| https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.md | Broken Link Third Party Advisory |
| https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0001.md | Exploit Third Party Advisory |
| https://www.sysaid.com/it-service-management-software/incident-management | Vendor Advisory |
Configurations
History
21 Nov 2024, 06:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.md - Broken Link, Third Party Advisory | |
| References | () https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0001.md - Exploit, Third Party Advisory | |
| References | () https://www.sysaid.com/it-service-management-software/incident-management - Vendor Advisory |
Information
Published : 2022-01-11 20:15
Updated : 2024-11-21 06:30
NVD link : CVE-2021-43974
Mitre link : CVE-2021-43974
CVE.ORG link : CVE-2021-43974
JSON object : View
Products Affected
sysaid
- itil
CWE
CWE-306
Missing Authentication for Critical Function