CVE-2020-15218

Published: Jan 13, 2021Modified: Nov 21, 2024

6.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Exploitability: 2.3 / Impact: 4.0

Source: NVD

Description

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, admin pages are cached, so that their content is visible after deconnection by using the browser back button. This is fixed in versions 2.7.2 and 3.0.0.

Affected (2)

Products: Combodo: Itop

Combodo

1 product

Itop

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Combodo Itop	Before 2.7.2
Combodo Itop	Version 3.0.0 alpha

Related CWEs

CWE-613

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (2)

https://github.com/Combodo/iTop/security/advisories/GHSA-3m3g-86hp-5p2j

Source: security-advisories@github.com

Third Party Advisory

https://github.com/Combodo/iTop/security/advisories/GHSA-3m3g-86hp-5p2j

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.