CVE-2022-25151: ITarian - Session cookie not protected by HttpOnly flag

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-06-09 · updated 2026-06-17
Weakness: CWE-614

Description

Within the Service Desk module of the ITarian platform (SAAS and on-premise), a remote attacker can obtain sensitive information, caused by the failure to set the HTTP Only flag. A remote attacker could exploit this vulnerability to gain access to the management interface by using this vulnerability in combination with a successful Cross-Site Scripting attack on a user.

Affected products

ITarian On-Premise: before 6.35.37347.20040 — fixed in 6.35.37347.20040
ITarian Saas Service Desk: before 6.35.37347.20040 — fixed in 6.35.37347.20040

How to fix

Upgrade to a fixed version: ITarian On-Premise 6.35.37347.20040; ITarian Saas Service Desk 6.35.37347.20040. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-25151 or the next vulnerability affects your stack