CVE-2020-4079

Published: Jan 12, 2021Modified: Nov 21, 2024

7.7

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Exploitability: 3.1 / Impact: 4.0

Source: NVD

Description

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access data they which they should not have access to. This is fixed in versions 2.7.2 and 3.0.0.

Affected (2)

Products: Combodo: Itop

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Combodo Itop	Before 2.7.2
Combodo Itop	Version 2.7.3

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://github.com/Combodo/iTop/security/advisories/GHSA-vcv9-xp3j-7jwh

Source: security-advisories@github.com

Third Party Advisory

https://github.com/Combodo/iTop/security/advisories/GHSA-vcv9-xp3j-7jwh

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.