{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-24T00:10:55.228","vulnerabilities":[{"cve":{"id":"CVE-2024-6202","sourceIdentifier":"vulnerability@ncsc.ch","published":"2024-08-06T06:15:35.487","lastModified":"2024-08-29T17:48:43.723","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"HaloITSM versions up to 2.146.1 are affected by a SAML XML Signature Wrapping (XSW) vulnerability. When having a SAML integration configured, anonymous actors could impersonate arbitrary HaloITSM users by just knowing their email address. HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability."},{"lang":"es","value":"Las versiones de HaloITSM hasta 2.146.1 se ven afectadas por una vulnerabilidad SAML XML Signature Wrapping (XSW). Al tener configurada una integración SAML, los actores anónimos podrían hacerse pasar por usuarios arbitrarios de HaloITSM con solo conocer su dirección de correo electrónico. Las versiones de HaloITSM posteriores a la 2.146.1 (y los parches a partir de la 2.143.61) corrigen la vulnerabilidad mencionada."}],"metrics":{"cvssMetricV31":[{"source":"vulnerability@ncsc.ch","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"weaknesses":[{"source":"vulnerability@ncsc.ch","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:haloservicesolutions:haloitsm:*:*:*:*:*:*:*:*","versionEndExcluding":"2.143.61","matchCriteriaId":"0C394C94-9968-465E-98B9-7BC8429BAD67"},{"vulnerable":true,"criteria":"cpe:2.3:a:haloservicesolutions:haloitsm:*:*:*:*:*:*:*:*","versionStartIncluding":"2.144","versionEndExcluding":"2.146.1","matchCriteriaId":"CEBD3BDE-57DA-41C9-821A-F8C6A8864FC7"}]}]}],"references":[{"url":"https://haloitsm.com/guides/article/?kbid=2154","source":"vulnerability@ncsc.ch","tags":["Vendor Advisory"]}]}}]}