PT-2024-37447 · Haloitsm · Haloitsm
CVE-2024-6202
·
Published
2024-08-06
·
Updated
2024-08-29
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
HaloITSM versions up to 2.146.1
Description:
The issue allows anonymous actors to impersonate arbitrary HaloITSM users by knowing their email address when a SAML integration is configured. This is due to a SAML XML Signature Wrapping (XSW) vulnerability.
Recommendations:
For HaloITSM versions up to 2.146.1, update to a version past 2.146.1 to fix the vulnerability.
For versions between 2.143.61 and 2.146.1, apply patches starting from 2.143.61 to resolve the issue.
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Haloitsm