# CVE-2023-47246

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.

- Page: https://www.vulneraibility.com/cve/CVE-2023-47246
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2023-11-13; CISA due date 2023-12-04; known ransomware use
- EPSS: 98.85% (percentile 99.9)
- Unvetted proof-of-concept code on GitHub: 1 GitHub proof of concept · 1 Nuclei template (first 2023-11-17)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2023-11-09)
- Weakness: CWE-22
- Published: 2023-11-10

## Affected

- sysaid:sysaid

## References

- [other] https://documentation.sysaid.com/docs/on-premise-security-enhancements-2023
- [other] https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
- [other] https://documentation.sysaid.com/docs/latest-version-installation-files
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-47246

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.