Lucene search

[email protected]CVE-2023-43790

HistoryApr 15, 2024 - 5:15 p.m.

CVE-2023-43790

2024-04-1517:15:07

CWE-80

CWE-79

[email protected]

web.nvd.nist.gov

itop

service management

http

query manipulation

vulnerability

fixed

version 3.1.1

version 3.2.0

5.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

5.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.8%

JSON

iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname value. This vulnerability is fixed in 3.1.1 and 3.2.0.

Affected configurations

Vulners

Node

combodoitopRange3.1.0–3..1.1

VendorProductVersionCPE
combodoitop*cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
combodo	itop	*	cpe:2.3:a:combodo:itop::::::::

CNA Affected

[
  {
    "vendor": "Combodo",
    "product": "iTop",
    "versions": [
      {
        "version": ">= 3.1.0, < 3..1.1",
        "status": "affected"
      }
    ]
  }
]

References

github.com/Combodo/iTop/commit/03c9ffc0334fd44f3f0e82477264087064e1c732

github.com/Combodo/iTop/security/advisories/GHSA-96xm-p83r-hm97

5.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

5.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.8%

JSON

Related for CVE-2023-43790

cvelist1 nvd1 osv1