CVE-2022-25151

Within the Service Desk module of the ITarian platform (SAAS and on-premise), a remote attacker can obtain sensitive information, caused by the failure to set the HTTP Only flag. A remote attacker could exploit this vulnerability to gain access to the management interface by using this vulnerability in combination with a successful Cross-Site Scripting attack on a user.

Score

CVSS 3.1 7.5 High

Status

Modified - csirt@divd.nl

Published

2022-06-09

Last modified

2025-03-11

Weaknesses

CWE-614, CWE-732

Affected products

• Itarian Saas Platform On-premise (Itarian)
• On-premise (Itarian)
• Saas Service Desk (Itarian)

References

• https://csirt.divd.nl/CVE-2022-25151
• https://csirt.divd.nl/DIVD-2021-00037