HaloITSM vulnerabilities

2 known vulnerabilities in HaloITSM from Halo Service Solutions. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  HaloITSM: Weak Password Recovery Mechanism for Forgotten Password

  CVE-2024-6203Aug 6, 2024Halo Service Solutions

  HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability. Poisoned password reset links can be sent to existing HaloITSM users (given their email address is known). When these poisoned links get accessed (e.g. manually by the vi

• 9.8 Critical severity

  HaloITSM: Incorrect Authorization

  CVE-2024-6202Aug 6, 2024Halo Service Solutions

  HaloITSM versions up to 2.146.1 are affected by a SAML XML Signature Wrapping (XSW) vulnerability. When having a SAML integration configured, anonymous actors could impersonate arbitrary HaloITSM users by just knowing their email address. HaloITSM versions pas