CVE-2022-26156

An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. Injection of a malicious payload within the RelayState= parameter of the HTTP request body results in the hijacking of the form action. Form-action hijacking vulnerabilities arise when an application places user-supplied input into the action URL of an HTML form. An attacker can use this vulnerability to construct a URL that, if visited by another application user, will modify the action URL of a form to point to the attacker's server.

• CWE-601

• https://github.com/l00neyhacker/CVE-2022-26156Third Party Advisory
• https://help.cherwell.com/bundle/release_notes_10_4_help_only/page/content/release_notes/10_4_0_fix_list.htmlRelease Notes, Vendor Advisory
• https://github.com/l00neyhacker/CVE-2022-26156Third Party Advisory
• https://help.cherwell.com/bundle/release_notes_10_4_help_only/page/content/release_notes/10_4_0_fix_list.htmlRelease Notes, Vendor Advisory

Published

Feb 28, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-26147The Quectel RG502Q-EA modem before 2022-02-23 allow OS Comma…9.8
• CVE-2022-26148An issue was discovered in Grafana through 7.3.4, when integ…9.8
• CVE-2022-26149MODX Revolution through 2.8.3-pl allows remote authenticated…7.2
• CVE-2022-2615Insufficient policy enforcement in Cookies in Google Chrome …6.5
• CVE-2022-26151Citrix XenMobile Server 10.12 through RP11, 10.13 through RP…7.2
• CVE-2022-26155An issue was discovered in the web application in Cherwell S…6.1
• CVE-2022-26157An issue was discovered in the web application in Cherwell S…5.3
• CVE-2022-26158An issue was discovered in the web application in Cherwell S…6.1
• CVE-2022-26159The auto-completion plugin in Ametys CMS before 4.5.0 allows…5.3
• CVE-2022-2616Inappropriate implementation in Extensions API in Google Chr…6.5
• CVE-2022-26169Air Cargo Management System v1.0 was discovered to contain a…9.8
• CVE-2022-2617Use after free in Extensions API in Google Chrome prior to 1…8.8