CVE-2023-45808

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-45808
iTop is an IT service management platform. When creating or updating an object, extkey values aren't checked to be in the current user silo. In other words, by forging an http request, the user can create objects pointing to out of silo objects (for example a UserRequest in an out of scope Organization). Fixed in iTop 2.7.10, 3.0.4, 3.1.1, and 3.2.0.

4.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/Combodo/iTop/commit/5a434486443a2cf8b8a288475aada54d0a068ca7 Patch
https://github.com/Combodo/iTop/commit/8f61c02cbe17badff87bff9b8ada85e783c47385 Patch
https://github.com/Combodo/iTop/security/advisories/GHSA-245j-66p9-pwmh Vendor Advisory
https://github.com/Combodo/iTop/commit/5a434486443a2cf8b8a288475aada54d0a068ca7 Patch
https://github.com/Combodo/iTop/commit/8f61c02cbe17badff87bff9b8ada85e783c47385 Patch
https://github.com/Combodo/iTop/security/advisories/GHSA-245j-66p9-pwmh Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*
cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*
cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*
History

06 Feb 2025, 20:58

Type Values Removed Values Added
CPE cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*
First Time Combodo
Combodo itop
References () https://github.com/Combodo/iTop/commit/5a434486443a2cf8b8a288475aada54d0a068ca7 - () https://github.com/Combodo/iTop/commit/5a434486443a2cf8b8a288475aada54d0a068ca7 - Patch
References () https://github.com/Combodo/iTop/commit/8f61c02cbe17badff87bff9b8ada85e783c47385 - () https://github.com/Combodo/iTop/commit/8f61c02cbe17badff87bff9b8ada85e783c47385 - Patch
References () https://github.com/Combodo/iTop/security/advisories/GHSA-245j-66p9-pwmh - () https://github.com/Combodo/iTop/security/advisories/GHSA-245j-66p9-pwmh - Vendor Advisory

21 Nov 2024, 08:27

Type Values Removed Values Added
Summary
  • (es) iTop es una plataforma de gestión de servicios de TI. Al crear o actualizar un objeto, no se verifica que los valores de extkey estén en el silo de usuario actual. En otras palabras, al falsificar una solicitud http, el usuario puede crear objetos que apunten a objetos fuera del silo (por ejemplo, una UserRequest en una organización fuera de alcance). Corregido en iTop 2.7.10, 3.0.4, 3.1.1 y 3.2.0.
References () https://github.com/Combodo/iTop/commit/5a434486443a2cf8b8a288475aada54d0a068ca7 - () https://github.com/Combodo/iTop/commit/5a434486443a2cf8b8a288475aada54d0a068ca7 -
References () https://github.com/Combodo/iTop/commit/8f61c02cbe17badff87bff9b8ada85e783c47385 - () https://github.com/Combodo/iTop/commit/8f61c02cbe17badff87bff9b8ada85e783c47385 -
References () https://github.com/Combodo/iTop/security/advisories/GHSA-245j-66p9-pwmh - () https://github.com/Combodo/iTop/security/advisories/GHSA-245j-66p9-pwmh -

15 Apr 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-15 18:15

Updated : 2025-02-06 20:58

NVD link : CVE-2023-45808

Mitre link : CVE-2023-45808

CVE.ORG link : CVE-2023-45808

JSON object : View

Products Affected

combodo

  • itop
CWE
CWE-639

Authorization Bypass Through User-Controlled Key