HaloITSM Guides
Documentation to assist with the setup and configuration of the HaloITSM platform
CVE-2024-6202 - SAML XML Signature Wrapping (XSW)
General Information
This article contains frequently asked questions relating to the XML signature wrapping vulnerability affecting Halo versions up to 2.143.8.
SAML XML signature wrapping is an attack method where an attacker modifies the signed SAML message without invalidating the signature.
This can lead to the attacker impersonating another user.
Are hosted Halo instances affected?
Hosted customers have been automatically updated to a patch to resolve this issue, and therefore no action is required by hosted customers. The patch was released on 2024-03-11 and hosted customers were upgraded shortly afterwards.
Are on-premises Halo instances affected?
Halo on-premises installations should apply the latest stable or beta patch to their Halo instance to resolve this issue.
- Any version >= 2.143.8
Next Steps
No action is required on the part of our customers.
We will continue to monitor our business infrastructure to ensure the same level of service and security that you expect.
Links
Popular Guides
- Asset Import - CSV/XLS/Spreadsheet Method
- Call Management in Halo
- Creating a New Application for API Connections
- Creating Agents and Editing Agent Details
- Departments, Teams and Roles
- Halo Integrator
- Importing Data
- Multiple New Portals with different branding for one customer [Hosted]
- NHServer Deprecation User Guide
- Organisation Basics
- Organising Teams of Agents
- Step-by-Step Configuration Walk Through
- Suppliers
