CVE-2022-26158

CVE-2022-26158 affects Cherwell Service Management (CSM) 10.2.3 web application, where a client-controlled Host header is reflected and can trigger a 302 redirect to an attacker-controlled page by injecting a malicious URL in Host. This creates an indirect navigation/redirect vulnerability. Affec...

CVE-2022-26157

CVE-2022-26157 affects Cherwell Service Management (CSM) 10.2.3. The issue is that the ASP.NET_Sessionid cookie is not protected with the Secure flag, allowing potential interception if traffic is not encrypted. The available documents consistently describe: the vulnerable component is the ASP.NE...

CVE-2022-26155

Cherwell Service Management (CSM) web application, version 10.2.3, is affected by an XSS vulnerability exploitable via a payload in the SAMLResponse parameter of the HTTP request body. The issue is documented across multiple sources (NVD, Red Hat, CVE repositories) with the same root cause: unesc...

CVE-2022-26156

CVE-2022-26156 affects Cherwell Service Management (CSM) web application, version 10.2.3. The issue is an injection of a malicious payload into the RelayState= parameter of the HTTP request body, causing form-action hijacking by altering the form submission URL to an attacker-controlled endpoint....