CVE-2022-25151 - OpenCVE

Within the Service Desk module of the ITarian platform (SAAS and on-premise), a remote attacker can obtain sensitive information, caused by the failure to set the HTTP Only flag. A remote attacker could exploit this vulnerability to gain access to the management interface by using this vulnerability in combination with a successful Cross-Site Scripting attack on a user.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Itarian	Saas Service Desk On-premise

Configuration 1 [-]

OR	cpe:2.3:a:itarian:on-premise::::::::
	cpe:2.3:a:itarian:saas_service_desk::::::::

References

Link	Resource
https://csirt.divd.nl/CVE-2022-25151	Third Party Advisory
https://csirt.divd.nl/DIVD-2021-00037	Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: DIVD

Published: 2022-02-23T00:00:00

Updated: 2024-05-22T20:18:15.627Z

Reserved: 2022-02-14T00:00:00

Link: CVE-2022-25151

JSON object: View

NVD Information

Status : Analyzed

Published: 2022-06-09T17:15:08.787

Modified: 2023-06-23T18:57:58.710

Link: CVE-2022-25151

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:itarian:on-premise:*:*:*:*:*:*:*:*", "matchCriteriaId": "A3E27C42-2DFA-4FC5-8B05-C120E35ABE75", "versionEndExcluding": "6.35.37347.20040", "vulnerable": true}, {"criteria": "cpe:2.3:a:itarian:saas_service_desk:*:*:*:*:*:*:*:*", "matchCriteriaId": "D8F85257-D85E-4E07-9CDE-0CE2146E354B", "versionEndExcluding": "6.35.37347.20040", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Within the Service Desk module of the ITarian platform (SAAS and on-premise), a remote attacker can obtain sensitive information, caused by the failure to set the HTTP Only flag. A remote attacker could exploit this vulnerability to gain access to the management interface by using this vulnerability in combination with a successful Cross-Site Scripting attack on a user."}, {"lang": "es", "value": "Dentro del m\u00f3dulo Service Desk de la plataforma ITarian (SAAS y on-premise), un atacante remoto puede conseguir informaci\u00f3n confidencial, causada por el fallo en la configuraci\u00f3n del flag HTTP Only. Un atacante remoto podr\u00eda explotar esta vulnerabilidad para conseguir acceso a la interfaz de administraci\u00f3n al usar esta vulnerabilidad en combinaci\u00f3n con un ataque con \u00e9xito de tipo Cross-Site Scripting a un usuario"}], "id": "CVE-2022-25151", "lastModified": "2023-06-23T18:57:58.710", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "csirt@divd.nl", "type": "Secondary"}]}, "published": "2022-06-09T17:15:08.787", "references": [{"source": "csirt@divd.nl", "tags": ["Third Party Advisory"], "url": "https://csirt.divd.nl/CVE-2022-25151"}, {"source": "csirt@divd.nl", "tags": ["Third Party Advisory"], "url": "https://csirt.divd.nl/DIVD-2021-00037"}], "sourceIdentifier": "csirt@divd.nl", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-614"}], "source": "csirt@divd.nl", "type": "Secondary"}]}