CVE-2022-25151 - ITarian - Session cookie not protected by HttpOnly flag

Back Back to CVE browser

HIGH

ITarian - Session cookie not protected by HttpOnly flag

Published Jun 8, 2022

7.5

HIGH

CVSS 3.1

EPSS 0.82%

Description

Within the Service Desk module of the ITarian platform (SAAS and on-premise), a remote attacker can obtain sensitive information, caused by the failure to set the HTTP Only flag. A remote attacker could exploit this vulnerability to gain access to the management interface by using this vulnerability in combination with a successful Cross-Site Scripting attack on a user.

Affected products

Vendor ITarian Product ITarian SaaS platform / on-premise Default
n/a
- Version
  any version
  Status
  affected
  Constraints
  <6.35.37347.20040

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ITarian

ITarian SaaS platform / on-premise

n/a

Version	Status	Constraints
any version	affected	<6.35.37347.20040

Vendor Itarian Product On-Premise Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <6.35.37347.20040
Vendor Itarian Product Saas Service Desk Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <6.35.37347.20040

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Itarian

On-Premise

n/a

Version	Status	Constraints
0	affected	<6.35.37347.20040

Itarian

Saas Service Desk

n/a

Version	Status	Constraints
0	affected	<6.35.37347.20040

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-614

CWE-732

Incorrect Permission Assignment

References (3)

https://csirt.divd.nl/CVE-2022-25151
x_refsource_CONFIRMthird-party-advisoryThird Party Advisory
https://csirt.divd.nl/DIVD-2021-00037
x_refsource_CONFIRMrelatedThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-29894
Advisory

Link	Providers	Tags
https://csirt.divd.nl/CVE-2022-25151		x_refsource_CONFIRMthird-party-advisoryThird Party Advisory
https://csirt.divd.nl/DIVD-2021-00037		x_refsource_CONFIRMrelatedThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-29894		Advisory