High severity8.8NVD Advisory· Published Jan 11, 2022· Updated Jun 17, 2026

CVE-2021-43973

Description

An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file via the file parameter in the HTTP POST body. A successful request returns the absolute, server-side filesystem path of the uploaded file.

Affected products

SysAid/SysAid ITILdescription
Sysaid/Sysaid2 versions
cpe:2.3:a:sysaid:sysaid:20.4.74:b10:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:sysaid:sysaid:20.4.74:b10:*:*:*:*:*:*
- (no CPE)range: 20.4.74 b10

Patches

Vulnerability mechanics

References

github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0001.mdnvdPatchThird Party Advisory
github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.mdnvdBroken Link
www.sysaid.com/it-service-management-software/incident-managementnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000