CVE-2022-26156

An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. Injection of a malicious payload within the RelayState= parameter of the HTTP request body results in the hijacking of the form action. Form-action hijacking vulnerabilities arise when an application places user-supplied input into the action URL of an HTML form. An attacker can use this vulnerability to construct a URL that, if visited by another application user, will modify the action URL of a form to point to the attacker's server.

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N

EPSS

0.72% chance of exploitation in the next 30 days, 52th percentile

Published

2022-02-28

Updated

2024-08-03

Proof-of-concept exploits (1)

• l00neyhacker/CVE-2022-261560★ · 2022-02-28

References

• CVE Record
• NVD entry

Related

• CVE-2021-31702
• CVE-2021-31703
• CVE-2021-32202
• CVE-2021-36581
• CVE-2021-36582
• CVE-2021-40649