CVE-2021-43974

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue was discovered in SysAid ITIL 20.4.74 b10. The /enduserreg endpoint is used to register end users anonymously, but does not respect the server-side setting that determines if anonymous users are allowed to register new accounts. Configuring the server-side setting to disable anonymous user registration only hides the client-side registration form. An attacker can still post registration data to create new accounts without prior authentication.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.mdBroken Link, Third Party Advisory
https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0001.mdExploit, Third Party Advisory
https://www.sysaid.com/it-service-management-software/incident-managementVendor Advisory
https://github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.mdBroken Link, Third Party Advisory
https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0001.mdExploit, Third Party Advisory
https://www.sysaid.com/it-service-management-software/incident-managementVendor Advisory

Timeline

Published: Jan 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-439756.7In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attac CVE-2021-439764.6In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (who can connect a cra CVE-2021-439776.1SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS.CVE-2021-439788.1Allegro WIndows 3.3.4152.0, embeds software administrator database credentials into its binary files, which allows users to access and modif CVE-2021-439795.3Styra Open Policy Agent (OPA) Gatekeeper through 3.7.0 mishandles concurrency, sometimes resulting in incorrect access control. The data rep CVE-2021-43984.3The Amministrazione Trasparente plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.1. Thi CVE-2021-439803.7The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long s CVE-2021-439819.8mySCADA myPRO: Versions 8.20.0 and prior has a feature to send emails, which may allow an attacker to inject arbitrary operating system comm CVE-2021-439827.8Delta Electronics CNCSoft Versions 1.01.30 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute CVE-2021-439837.8WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to multiple stack-based buffer overflow instances while parsing project files CVE-2021-439849.8mySCADA myPRO: Versions 8.20.0 and prior has a feature where the firmware can be updated, which may allow an attacker to inject arbitrary op CVE-2021-439859.8An unauthenticated remote attacker can access mySCADA myPRO Versions 8.20.0 and prior without any form of authentication or authorization.