Lucene search

GitHub_MVULNRICHMENT:CVE-2023-43790

HistoryApr 15, 2024 - 5:10 p.m.

CVE-2023-43790 iTop vulnerable to XSS in friendlyname in object details

2024-04-1517:10:39

CWE-80

CWE-79

GitHub_M

github.com

itop

xss

friendlyname

http queries

object details

vulnerability

fixed

3.1.1

3.2.0

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

AI Score

6.8

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname value. This vulnerability is fixed in 3.1.1 and 3.2.0.

CNA Affected

[
  {
    "vendor": "Combodo",
    "product": "iTop",
    "versions": [
      {
        "status": "affected",
        "version": ">= 3.1.0, < 3..1.1"
      }
    ]
  }
]

References

github.com/Combodo/iTop/commit/03c9ffc0334fd44f3f0e82477264087064e1c732

github.com/Combodo/iTop/security/advisories/GHSA-96xm-p83r-hm97

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

AI Score

6.8

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2023-43790