Vulnerability · Published Jun 8, 2022 · Assigned by DIVD

CVE-2022-25152ITarian - Any user with a valid session token can create and execute agent procedures and bypass mandatory approvals

Critical 9.9

In plain English

A critical-severity security flaw in ITarian platform (SAAS / on-premise) from ITarian. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)1.9%top 20.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The ITarian platform (SAAS / on-premise) offers the possibility to run code on agents via a function called procedures. It is possible to require a mandatory approval process. Due to a vulnerability in the approval process, present in any version prior to 6.35.37347.20040, a malicious actor (with a valid session token) can create a procedure, bypass approval, and execute the procedure. This results in the ability for any user with a valid session token to perform arbitrary code execution and full system take-over on all agents.

Affected products (as reported)

Vendor	Product	Versions
ITarian	ITarian platform (SAAS / on-premise)	any version – before 6.35.37347.20040

Weakness: CWE-358 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://csirt.divd.nl/DIVD-2021-00037 x_refsource_CONFIRM, related
https://csirt.divd.nl/CVE-2022-25152 x_refsource_CONFIRM, third-party-advisory