CVE-2022-26156

Katalog CVE

CVSS 6.1 · Medium EPSS 0,72%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada cherwell service management. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. Injection of a malicious payload within the RelayState= parameter of the HTTP request body results in the hijacking of the form action. Form-action hijacking vulnerabilities arise when an application places user-supplied input into the action URL of an HTML form. An attacker can use this vulnerability to construct a URL that, if visited by another application user, will modify the action URL of a form to point to the attacker's server.

Rincian

Terbit di NVD

28 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,72% peluang dieksploitasi; lebih tinggi dari 52,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://help.cherwell.com/bundle/release_notes_10_4_help_only/page/content/release_notes/10_4_0_fix_list.html release notes · advisory vendor
• https://github.com/l00neyhacker/CVE-2022-26156 advisory pihak ketiga