cve.bz

CVE-2022-26157

5.3 mediumEPSS 0.6%

Medium (5.3) in cherwell cherwell service management. EPSS 0.6% chance of exploitation in the next 30 days.

An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. The ASP.NET_Sessionid cookie is not protected by the Secure flag. This makes it prone to interception by an attacker if traffic is sent over unencrypted channels.

Severity

CVSS 3.1

5.3 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS
0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE
CWE-311
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON