QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2022-25152

Back to search

CVE-2022-25152

Published: Jun 8, 2022

Modified: Mar 11, 2025

PUBLISHED

CVSS v3.1

9.9

CRITICAL

Description

The ITarian platform (SAAS / on-premise) offers the possibility to run code on agents via a function called procedures. It is possible to require a mandatory approval process. Due to a vulnerability in the approval process, present in any version prior to 6.35.37347.20040, a malicious actor (with a valid session token) can create a procedure, bypass approval, and execute the procedure. This results in the ability for any user with a valid session token to perform arbitrary code execution and full system take-over on all agents.

VendorProductVersions

ITarian

ITarian platform (SAAS / on-premise)

affected
any version - < 6.35.37347.20040

Weaknesses (CWE)

CWE-358

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

References

https://csirt.divd.nl/DIVD-2021-00037
x_refsource_CONFIRM
related
https://csirt.divd.nl/CVE-2022-25152
x_refsource_CONFIRM
third-party-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now