medium6.1
CVE-2022-26158
An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3.
Impact
An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. It accepts and reflects arbitrary domains supplied via a client-controlled Host header. Injection of a malicious URL in the Host: header of the HTTP Request results in a 302 redirect to an attacker-controlled page.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cherwell | Cherwell Service Management | Version 10.2.3 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/l00neyhacker/CVE-2022-26158
- https://help.cherwell.com/bundle/release_notes_10_4_help_only/page/content/release_notes/10_4_0_fix_list.html
- https://github.com/l00neyhacker/CVE-2022-26158
- https://help.cherwell.com/bundle/release_notes_10_4_help_only/page/content/release_notes/10_4_0_fix_list.html