medium5.3
CVE-2022-26157
An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3.
Impact
An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. The ASP.NET_Sessionid cookie is not protected by the Secure flag. This makes it prone to interception by an attacker if traffic is sent over unencrypted channels.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cherwell | Cherwell Service Management | Version 10.2.3 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/l00neyhacker/CVE-2022-26157
- https://help.cherwell.com/bundle/release_notes_10_4_help_only/page/content/release_notes/10_4_0_fix_list.html
- https://github.com/l00neyhacker/CVE-2022-26157
- https://help.cherwell.com/bundle/release_notes_10_4_help_only/page/content/release_notes/10_4_0_fix_list.html