CVE-2023-48710criticalCWE-552

CVE-2023-48710: falha crítica em Combodo iTop

iTop limit pages/exec.php script to PHP files

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar iTop

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 0.7%
iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted access. Hopefully, there is no sensitive files stored in that folder natively, but there could be from a third-party module. The `pages/exec.php` script as been fixed to limit execution of PHP files only. Other file types won't be retrieved and exposed. The vulnerability is fixed in 2.7.10, 3.0.4, 3.1.1, and 3.2.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Combodo · iTop
CVEs relacionadas — Combodo iTop

No mesmo produto, das mais perigosas para as menos.

CVE-2022-39214CRITICALAuthenticated users of Combodo iTop can take over any accountEPSS 25.6%CVE-2022-24780HIGHCode Injection in Combodo iTopEPSS 5.7%CVE-2021-32663HIGHUnauthorized setup leads to SSRF in Combodo/iTopEPSS 1.5%CVE-2020-12777HIGHCombodo iTop - Broken Access ControlEPSS 1.3%CVE-2024-51739HIGHUsers enumeration allowed through Rest API in Combodo iTopEPSS 1.2%CVE-2020-12780HIGHCombodo iTop - Security MisconfigurationEPSS 1.2%