CVE-2022-25152
Due to a vulnerability in the approval process, present in any version prior to 6.35.37347.20040, a malicious actor (with a valid session token) can create a procedure, bypass approval, and execute the procedure.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.79%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The ITarian platform (SAAS / on-premise) offers the possibility to run code on agents via a function called procedures. It is possible to require a mandatory approval process. Due to a vulnerability in the approval process, present in any version prior to 6.35.37347.20040, a malicious actor (with a valid session token) can create a procedure, bypass approval, and execute the procedure. This results in the ability for any user with a valid session token to perform arbitrary code execution and full system take-over on all agents.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.79% probability · 77th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-358
- Affected
- itarian/on-premise · itarian/saas service desk
- Source
- csirt@divd.nl
References
- https://csirt.divd.nl/CVE-2022-25152Third Party Advisory
- https://csirt.divd.nl/DIVD-2021-00037Third Party Advisory
- https://csirt.divd.nl/CVE-2022-25152Third Party Advisory
- https://csirt.divd.nl/DIVD-2021-00037Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.