CVE-2022-26157

2022-02-2815:25:10

mitre

www.cve.org

cherwell service management

cookie security

unencrypted traffic

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

33.5%

JSON

An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. The ASP.NET_Sessionid cookie is not protected by the Secure flag. This makes it prone to interception by an attacker if traffic is sent over unencrypted channels.