CVE-2022-25152: ITarian - Any user with a valid session token can create and execute agent procedures and bypass mandatory approvals

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-06-09 · updated 2026-06-17
Weakness: CWE-358

Description

The ITarian platform (SAAS / on-premise) offers the possibility to run code on agents via a function called procedures. It is possible to require a mandatory approval process. Due to a vulnerability in the approval process, present in any version prior to 6.35.37347.20040, a malicious actor (with a valid session token) can create a procedure, bypass approval, and execute the procedure. This results in the ability for any user with a valid session token to perform arbitrary code execution and full system take-over on all agents.

Affected products

ITarian On-Premise: before 6.35.37347.20040 — fixed in 6.35.37347.20040
ITarian Saas Service Desk: before 6.35.37347.20040 — fixed in 6.35.37347.20040

How to fix

Upgrade to a fixed version: ITarian On-Premise 6.35.37347.20040; ITarian Saas Service Desk 6.35.37347.20040. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-25152 or the next vulnerability affects your stack