dbcve.org
On PremiseApplication · Itarian

CVE-2022-25152

HIGH · 8.8 CVSS v3.1 Published 2022-06-09
Fix available
A fix is available. Upgrade to 6.35.37347.20040 or later.
See remediation →
94/100
Remediation priority · Urgent
Remotely reachable Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
The ITarian platform (SAAS / on-premise) offers the possibility to run code on agents via a function called procedures. It is possible to require a mandatory approval process. Due to a vulnerability in the approval process, present in any version prior to 6.35.37347.20040, a malicious actor (with a valid session token) can create a procedure, bypass approval, and execute the procedure. This results in the ability for any user with a valid session token to perform arbitrary code execution and full system take-over on all agents.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

The ITarian platform has a vulnerability in its procedure approval mechanism that allows any user with a valid session token to bypass the mandatory approval process. An authenticated attacker can create a procedure, circumvent approval requirements, and execute it on all managed agents, resulting in arbitrary code execution and complete system take-over.

MitigationUpgrade ITarian to version 6.35.37347.20040 or later. Additionally, audit existing session tokens and procedures for signs of compromise, and rotate credentials as a precautionary measure.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
On PremiseApplication
Affected:< 6.35.37347.20040
Saas Service DeskApplication
Affected:< 6.35.37347.20040

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check Itarian On Premise version
    Log into the ITarian On Premise admin console and navigate to Help > About or System > Status to view the installed platform version. Alternatively, check the application manifest or version file in the installation directory.
    Affected if The displayed version is less than 6.35.37347.20040
  2. Check Itarian Saas Service Desk version
    Log into the ITarian SaaS Service Desk portal and navigate to the administration or settings panel to locate the platform version information.
    Affected if The displayed version is less than 6.35.37347.20040
  3. Verify procedure approval enforcement
    Navigate to the procedure or workflow configuration settings in the ITarian admin console. Locate the approval requirement settings for procedures and verify whether the mandatory approval enforcement is properly enabled and functioning.
    Affected if The approval mechanism can be bypassed or the approval enforcement toggle is disabled or missing
  4. Review procedure execution audit logs
    Access the ITarian audit or activity logs and search for recent procedure executions. Look for entries showing procedures that were created, approved, and executed, paying attention to any timestamps that indicate bypassing the normal approval workflow.
    Affected if Any procedures were executed without corresponding approval records in the logs, or there are procedures executed in rapid succession without approval timestamps

You are affected if your ITarian On Premise or SaaS Service Desk version is below 6.35.37347.20040 and the procedure approval bypass can be exploited in your configuration.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 6.35.37347.20040 or later
Fixed in 6.35.37347.20040
Interim mitigation

Upgrade ITarian to version 6.35.37347.20040 or later. Additionally, audit existing session tokens and procedures for signs of compromise, and rotate credentials as a precautionary measure.

Recommended fix High confidence

6.35.37347.20040 or later

  1. Upgrade the ITarian On Premise installation to version 6.35.37347.20040 or later
  2. If using SaaS Service Desk, ensure your provider has applied the update to version 6.35.37347.20040 or later
  3. After upgrade, verify that the procedure approval workflow is enforced correctly
  4. Confirm that users can no longer bypass the mandatory approval process for procedures
  5. Validate that arbitrary code execution is no longer possible without proper approval

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in On Premise Scoped from the published advisory
  • Consultation6.0 h
  • Implementation12.0 h
  • Testing6.0 h
  • Review / QA3.0 h
27.0 hours of engineering $4,800
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $7,680.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2022-25152 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2022-25152 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data