CVE-2019-11215

CVE-2019-11215 affects Combodo iTop versions 2.2.0–2.6.0. If the configuration file is writable, an attacker can achieve arbitrary code execution by sending a crafted payload to the ajax.dataloader API. The condition for writability can arise during installation, upgrade, a web-interface write er...