CVE-2022-26158

An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3

published February 28, 2022

CVSS
—
EPSS
1%
Percentile
53.5
In the wild
Unconfirmed
What it is

An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. It accepts and reflects arbitrary domains supplied via a client-controlled Host header. Injection of a malicious URL in the Host: header of the HTTP Request results in a 302 redirect to an attacker-controlled page.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00724 · 53.5th percentile
Published
2022-02-28T15:25Z
EPSS history
Timeline
  • 28 FEB 15:25Z
    An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3
    cvelistv5