Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ITarian - Any user with a valid session token can create and execute agent procedures and bypass mandatory approvals
Vulnerability Description
The ITarian platform (SAAS / on-premise) offers the possibility to run code on agents via a function called procedures. It is possible to require a mandatory approval process. Due to a vulnerability in the approval process, present in any version prior to 6.35.37347.20040, a malicious actor (with a valid session token) can create a procedure, bypass approval, and execute the procedure. This results in the ability for any user with a valid session token to perform arbitrary code execution and full system take-over on all agents.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability Type
不恰当实现的标准安全检查
Vulnerability Title
ITarian Saas platform 安全漏洞
Vulnerability Description
ITarian是美国ITarian公司的一种远程访问和 IT 管理解决方案。可帮助组织与其客户和员工建立联系和沟通，促进跨团队的远程文件访问、系统监控、故障排除和运营管理。 ITarian Saas platform 3.49.0之前版本，存在安全漏洞，该漏洞源于在使用代理运行代码的批准过程中存在漏洞，攻击者利用该漏洞可以执行任意代码且接管系统。
CVSS Information
N/A
Vulnerability Type
N/A