iTop Platform Vulnerability Affects Restricted Access Files

CVE-2023-48710

What is CVE-2023-48710?

The iTop platform, developed by Combodo, is susceptible to a file access vulnerability that may allow unauthorized retrieval of files from the env-production folder. Although this directory is intended to have restricted access, improper configurations could lead to the exposure of sensitive data, particularly if third-party modules have been employed. Recent updates have addressed this issue by limiting the execution of PHP files through the pages/exec.php script, thereby enhancing security. The vulnerability has been resolved in various iTop versions, notably 2.7.10, 3.0.4, 3.1.1, and 3.2.0.

References