PT-2022-23244 · Freshservice · Freshservice Macos Agent+2

Joona Hoikkala + 1 · Published 2022-09-12 · Updated 2022-09-15 · CVE-2022-36174

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreshService Windows Agent versions prior to 2.11.0 FreshService macOS Agent versions prior to 4.2.0 FreshService Linux Agent versions prior to 3.3.0

Description The issue is related to broken integrity checking via the FreshAgent client and scheduled update service.

Recommendations For FreshService Windows Agent versions prior to 2.11.0, update to version 2.11.0 or later. For FreshService macOS Agent versions prior to 4.2.0, update to version 4.2.0 or later. For FreshService Linux Agent versions prior to 3.3.0, update to version 3.3.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2022-36174

Affected Products

Freshservice Linux Agent

Freshservice Windows Agent

Freshservice Macos Agent

References · 5

• 🔥 https://public-exposure.inform.social/post/integrity-checking · Exploit
• https://osv.dev/vulnerability/CVE-2022-36174 · Vendor Advisory
• https://community.freshworks.com/product-updates/freshservice-release-notes-april-2022-23982#Security+updates:+Discovery+Probe+and+Discovery+Agent · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36174 · Security Note
• https://t.me/cibsecurity/49611 · Telegram Post