Cherwell

Cherwell Service Management

4 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2022-26155

  • EPSS 0.53%
  • Veröffentlicht 28.02.2022 16:15:08
  • Zuletzt bearbeitet 21.11.2024 06:53:32

An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. XSS can occur via a payload in the SAMLResponse parameter of the HTTP request body.

6.1

CVE-2022-26156

  • EPSS 0.2%
  • Veröffentlicht 28.02.2022 16:15:08
  • Zuletzt bearbeitet 21.11.2024 06:53:32

An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. Injection of a malicious payload within the RelayState= parameter of the HTTP request body results in the hijacking of the form action. Form-action hijacking ...

5.3

CVE-2022-26157

  • EPSS 0.17%
  • Veröffentlicht 28.02.2022 16:15:08
  • Zuletzt bearbeitet 21.11.2024 06:53:32

An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. The ASP.NET_Sessionid cookie is not protected by the Secure flag. This makes it prone to interception by an attacker if traffic is sent over unencrypted chann...

6.1

CVE-2022-26158

  • EPSS 0.2%
  • Veröffentlicht 28.02.2022 16:15:08
  • Zuletzt bearbeitet 21.11.2024 06:53:32

An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. It accepts and reflects arbitrary domains supplied via a client-controlled Host header. Injection of a malicious URL in the Host: header of the HTTP Request r...