Information disclosure vulnerability in iTop
CVE-2020-4079

7.7HIGH

Key Information:

Vendor

Combodo

Status
Itop
Vendor
CVE Published:
12 January 2021

What is CVE-2020-4079?

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access data they which they should not have access to. This is fixed in versions 2.7.2 and 3.0.0.

Affected Version(s)

iTop < 2.7.2

References

https://github.com/Combodo/iTop/security/advisories/GHSA-...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.