ITarian

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

ITarian records in CISA KEV

No ITarian vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

On-premise 2 records MEDIUM Saas Service Desk 2 records MEDIUM Endpoint Manager Communication Client 1 record LOW

Records

3 records

TI-2022-08865 CVE-2022-25152 · GHSA-cwjr-66gj-xm4q

ITarian - Any user with a valid session token can create and execute agent procedures and bypass mandatory approvals

MEDIUM 53

The ITarian platform (SAAS / on-premise) offers the possibility to run code on agents via a function called procedures.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01893 Published 2022-06-08 Fixed in 6.35.37347.20040 CWE-358

TI-2022-08864 CVE-2022-25151 · GHSA-74c8-v93w-3c2c

ITarian - Session cookie not protected by HttpOnly flag

LOW 36

Within the Service Desk module of the ITarian platform (SAAS and on-premise), a remote attacker can obtain sensitive information, caused by the failure to set the HTTP Only flag.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00835 Published 2022-06-08 Fixed in 6.35.37347.20040 CWE-614

TI-2022-08866 CVE-2022-25153 · GHSA-h8h7-rvv3-mqvp

ITarian - Local privilege escalation in Endpoint Manager agent on Windows

LOW 34

The ITarian Endpoint Manage Communication Client, prior to version 6.43.41148.21120, is compiled using insecure OpenSSL settings.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00342 Published 2022-06-08 Fixed in 6.43.41148.21120 CWE-275

Open these records in search →

Critical	1
High	2
Medium	0
Low	0
No CVSS	0