Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2024-6202

HaloITSM - SAML XML Signature Wrapping (XSW)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
NCSC.ch

Description

HaloITSM versions up to 2.146.1 are affected by a SAML XML Signature Wrapping (XSW) vulnerability. When having a SAML integration configured, anonymous actors could impersonate arbitrary HaloITSM users by just knowing their email address. HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Halo Service Solutions HaloITSM

Default version status: unaffected

  • < 2.146.1affected

References