CVE-2015-2997
SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an...
CVE-2015-2997 is a medium vulnerability (CVSS 5.0) in Sysaid, published June 8, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 57.0%, the 99th percentile. No source names a fixed version.
SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an invalid value in the accountid parameter to getAgentLogFile, as demonstrated by a large directory traversal sequence, which reveals the installation path in an error message.
Exploit likelihood
What each source reports
NVD Score used
SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an invalid value in the accountid parameter to getAgentLogFile, as demonstrated by a large directory traversal sequence, which reveals the installation path in an error message.
- Record
CVE-2015-2997- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an invalid value in the accountid parameter to getAgentLogFile, as demonstrated by a large directory traversal sequence, which reveals the installation path in an error message.
- Record
CVE-2015-2997- Updated
- 2026-11-02
EUVDEUVD-2015-3079 No score
SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an invalid value in the accountid parameter to getAgentLogFile, as demonstrated by a large directory traversal sequence, which reveals the installation path in an error message.
- Record
EUVD-2015-3079- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-76mr-hhhx-xpg8 No score
SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an...
SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an invalid value in the accountid parameter to getAgentLogFile, as demonstrated by a large directory traversal sequence, which reveals the installation path in an error message.
- Record
GHSA-76mr-hhhx-xpg8- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | SysAid Help Desk 14.4 - Multiple Vulnerabilities | 2015-06-10 |
| Metasploit | SysAid Help Desk Arbitrary File Download | 2015-06-03 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
References
seclists.org/fulldisclosure/2015/Jun/8
securityfocus.com/archive/1/535679/100/0/threaded
packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html
sysaid.com/blog/entry/sysaid-15-2-your-voice-your-service-desk
nvd.nist.gov/vuln/detail/CVE-2015-2997
github.com/advisories/GHSA-76mr-hhhx-xpg8