CVE-2022-26157

Name of the Vulnerable Software and Affected Versions Cherwell Service Management version 10.2.3

Description An issue was discovered in the web application where the ASP.NET Sessionid cookie is not protected by the Secure flag, making it prone to interception by an attacker if traffic is sent over unencrypted channels.

Recommendations For Cherwell Service Management version 10.2.3, consider configuring the web application to protect the ASP.NET Sessionid cookie with the Secure flag to prevent interception over unencrypted channels. As a temporary workaround, restrict access to unencrypted channels to minimize the risk of exploitation.