Vulnerability · Published Apr 15, 2024 · Assigned by GitHub_M

CVE-2023-38511iTop Dashboard editor vulnerable dashboard config file parameter

Medium 5.0

In plain English

A medium-severity path traversal in iTop from Combodo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.7%top 47.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

iTop is an IT service management platform. Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnerability is fixed in 3.0.4 and 3.1.1.

Affected products (as reported)

Vendor	Product	Versions
Combodo	iTop	>= 3.0.0, < 3.0.4>= 3.1.0, < 3.1.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

References

https://github.com/Combodo/iTop/security/advisories/GHSA-323r-chx5-m9gm x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/343e87a8d4fc8253fd81aeaf0dcc424b9dc4eda7 x_refsource_MISC
https://github.com/Combodo/iTop/commit/89145593ef2e077529a6f7ee7cde712db637e1ab x_refsource_MISC
https://www.synacktiv.com/advisories/file-read-in-itop x_refsource_MISC