Vulnerability · Published Jun 8, 2022 · Assigned by DIVD

CVE-2022-25151ITarian - Session cookie not protected by HttpOnly flag

High 7.5

In plain English

A high-severity security flaw in ITarian SaaS platform / on-premise from ITarian. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.8%top 42.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Within the Service Desk module of the ITarian platform (SAAS and on-premise), a remote attacker can obtain sensitive information, caused by the failure to set the HTTP Only flag. A remote attacker could exploit this vulnerability to gain access to the management interface by using this vulnerability in combination with a successful Cross-Site Scripting attack on a user.

Affected products (as reported)

Vendor	Product	Versions
ITarian	ITarian SaaS platform / on-premise	any version – before 6.35.37347.20040

Weakness: CWE-614 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://csirt.divd.nl/DIVD-2021-00037 x_refsource_CONFIRM, related
https://csirt.divd.nl/CVE-2022-25151 x_refsource_CONFIRM, third-party-advisory