Vulnerabilities

TI-2022-08866 CVE-2022-25153 · GHSA-h8h7-rvv3-mqvp

ITarian - Local privilege escalation in Endpoint Manager agent on Windows

LOW 34

The ITarian Endpoint Manage Communication Client, prior to version 6.43.41148.21120, is compiled using insecure OpenSSL settings.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00342 Published 2022-06-08 Fixed in 6.43.41148.21120 CWE-275

TI-2022-08865 CVE-2022-25152 · GHSA-cwjr-66gj-xm4q

ITarian - Any user with a valid session token can create and execute agent procedures and bypass mandatory approvals

MEDIUM 53

The ITarian platform (SAAS / on-premise) offers the possibility to run code on agents via a function called procedures.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01893 Published 2022-06-08 Fixed in 6.35.37347.20040 CWE-358

TI-2022-08864 CVE-2022-25151 · GHSA-74c8-v93w-3c2c

ITarian - Session cookie not protected by HttpOnly flag

LOW 36

Within the Service Desk module of the ITarian platform (SAAS and on-premise), a remote attacker can obtain sensitive information, caused by the failure to set the HTTP Only flag.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00835 Published 2022-06-08 Fixed in 6.35.37347.20040 CWE-614

Vulnerabilities

Filters

ITarian - Local privilege escalation in Endpoint Manager agent on Windows

ITarian - Any user with a valid session token can create and execute agent procedures and bypass mandatory approvals

ITarian - Session cookie not protected by HttpOnly flag