CVE-2023-38511

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-38511
iTop is an IT service management platform. Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnerability is fixed in 3.0.4 and 3.1.1.

5.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/Combodo/iTop/commit/343e87a8d4fc8253fd81aeaf0dcc424b9dc4eda7 Patch
https://github.com/Combodo/iTop/commit/89145593ef2e077529a6f7ee7cde712db637e1ab Patch
https://github.com/Combodo/iTop/security/advisories/GHSA-323r-chx5-m9gm Vendor Advisory
https://www.synacktiv.com/advisories/file-read-in-itop Exploit Third Party Advisory
https://github.com/Combodo/iTop/commit/343e87a8d4fc8253fd81aeaf0dcc424b9dc4eda7 Patch
https://github.com/Combodo/iTop/commit/89145593ef2e077529a6f7ee7cde712db637e1ab Patch
https://github.com/Combodo/iTop/security/advisories/GHSA-323r-chx5-m9gm Vendor Advisory
https://www.synacktiv.com/advisories/file-read-in-itop Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*
cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*
History

06 Feb 2025, 20:55

Type Values Removed Values Added
CPE cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*
First Time Combodo
Combodo itop
References () https://github.com/Combodo/iTop/commit/343e87a8d4fc8253fd81aeaf0dcc424b9dc4eda7 - () https://github.com/Combodo/iTop/commit/343e87a8d4fc8253fd81aeaf0dcc424b9dc4eda7 - Patch
References () https://github.com/Combodo/iTop/commit/89145593ef2e077529a6f7ee7cde712db637e1ab - () https://github.com/Combodo/iTop/commit/89145593ef2e077529a6f7ee7cde712db637e1ab - Patch
References () https://github.com/Combodo/iTop/security/advisories/GHSA-323r-chx5-m9gm - () https://github.com/Combodo/iTop/security/advisories/GHSA-323r-chx5-m9gm - Vendor Advisory
References () https://www.synacktiv.com/advisories/file-read-in-itop - () https://www.synacktiv.com/advisories/file-read-in-itop - Exploit, Third Party Advisory

21 Nov 2024, 08:13

Type Values Removed Values Added
Summary
  • (es) iTop es una plataforma de gestión de servicios de TI. Editor de panel: puede cargar varios archivos y URL, y revelar la ruta completa en el archivo de configuración del panel. Esta vulnerabilidad se solucionó en 3.0.4 y 3.1.1.
References () https://github.com/Combodo/iTop/commit/343e87a8d4fc8253fd81aeaf0dcc424b9dc4eda7 - () https://github.com/Combodo/iTop/commit/343e87a8d4fc8253fd81aeaf0dcc424b9dc4eda7 -
References () https://github.com/Combodo/iTop/commit/89145593ef2e077529a6f7ee7cde712db637e1ab - () https://github.com/Combodo/iTop/commit/89145593ef2e077529a6f7ee7cde712db637e1ab -
References () https://github.com/Combodo/iTop/security/advisories/GHSA-323r-chx5-m9gm - () https://github.com/Combodo/iTop/security/advisories/GHSA-323r-chx5-m9gm -
References () https://www.synacktiv.com/advisories/file-read-in-itop - () https://www.synacktiv.com/advisories/file-read-in-itop -

15 Apr 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-15 17:15

Updated : 2025-02-06 20:55

NVD link : CVE-2023-38511

Mitre link : CVE-2023-38511

CVE.ORG link : CVE-2023-38511

JSON object : View

Products Affected

combodo

  • itop
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')