Lucene search

MitreCVE-2022-26158

HistoryFeb 28, 2022 - 4:15 p.m.

CVE-2022-26158

2022-02-2816:15:08

CWE-601

mitre

web.nvd.nist.gov

cve-2022-26158

cherwell service management

csm 10.2.3

web application

injection vulnerability

host header

http request

302 redirect

nvd

security vulnerability

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

33.5%

JSON

An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. It accepts and reflects arbitrary domains supplied via a client-controlled Host header. Injection of a malicious URL in the Host: header of the HTTP Request results in a 302 redirect to an attacker-controlled page.

Affected configurations

Nvd

Node

cherwellcherwell_service_managementMatch10.2.3

VendorProductVersionCPE
cherwellcherwell_service_management10.2.3cpe:2.3:a:cherwell:cherwell_service_management:10.2.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cherwell	cherwell_service_management	10.2.3	cpe:2.3:a:cherwell:cherwell_service_management:10.2.3:::::::*

References

github.com/l00neyhacker/CVE-2022-26158

help.cherwell.com/bundle/release_notes_10_4_help_only/page/content/release_notes/10_4_0_fix_list.html

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

33.5%

JSON

Related for CVE-2022-26158