Vulnerabilities > CVE-2024-6202 - Incorrect Authorization vulnerability in Haloservicesolutions Haloitsm
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
HaloITSM versions up to 2.146.1 are affected by a SAML XML Signature Wrapping (XSW) vulnerability. When having a SAML integration configured, anonymous actors could impersonate arbitrary HaloITSM users by just knowing their email address. HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 5 |