CVSS: 8.7EPSS: 0%CPEs: 1EXPL: 0CVE-2023-47123 – iTop vulnerable to XSS vulnerability in n:n relations "tagset" widget
https://notcve.org/view.php?id=CVE-2023-47123
iTop is an IT service management platform. By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this object will displayed as an n:n relation item in another object. This vulnerability is fixed in 3.1.1 and 3.2.0. iTop es una plataforma de gestión de servicios de TI. Al completar código malicioso en un nombre descriptivo/nombre complementario de un objeto, se puede realizar un ataque XSS cuando este objeto se muestra como un elemento de relación n:n en otro objeto. Esta vulnerabilidad se solucionó en 3.1.1 y 3.2.0. • https://github.com/Combodo/iTop/commit/34ba4fa0ce99534f751d9f170fe0eda103e20c72 https://github.com/Combodo/iTop/security/advisories/GHSA-mx8x-693w-9hjp • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.1EPSS: 0%CPEs: 3EXPL: 0CVE-2023-45808 – iTop missing silo check on extkey in console and portal
https://notcve.org/view.php?id=CVE-2023-45808
iTop is an IT service management platform. When creating or updating an object, extkey values aren't checked to be in the current user silo. In other words, by forging an http request, the user can create objects pointing to out of silo objects (for example a UserRequest in an out of scope Organization). Fixed in iTop 2.7.10, 3.0.4, 3.1.1, and 3.2.0. iTop es una plataforma de gestión de servicios de TI. Al crear o actualizar un objeto, no se verifica que los valores de extkey estén en el silo de usuario actual. • https://github.com/Combodo/iTop/commit/5a434486443a2cf8b8a288475aada54d0a068ca7 https://github.com/Combodo/iTop/commit/8f61c02cbe17badff87bff9b8ada85e783c47385 https://github.com/Combodo/iTop/security/advisories/GHSA-245j-66p9-pwmh • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-44396 – iTop vulnerable to XSS in dashlet modifications ajax endpoints
https://notcve.org/view.php?id=CVE-2023-44396
iTop is an IT service management platform. Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1. iTop es una plataforma de gestión de servicios de TI. Dashlet edita los endpoints ajax y se puede utilizar para producir XSS. Corregido en iTop 2.7.10, 3.0.4 y 3.1.1. • https://github.com/Combodo/iTop/commit/9df92665e08c4bf5d4d8a5a9fe21fd3fb26fb273 https://github.com/Combodo/iTop/commit/c72cb7e70ebf469ce0ec01f5f9b524e39afe6c7f https://github.com/Combodo/iTop/security/advisories/GHSA-gqqj-jgh6-3x35 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-38511 – iTop Dashboard editor vulnerable dashboard config file parameter
https://notcve.org/view.php?id=CVE-2023-38511
iTop is an IT service management platform. Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnerability is fixed in 3.0.4 and 3.1.1. iTop es una plataforma de gestión de servicios de TI. Editor de panel: puede cargar varios archivos y URL, y revelar la ruta completa en el archivo de configuración del panel. Esta vulnerabilidad se solucionó en 3.0.4 y 3.1.1. • https://github.com/Combodo/iTop/commit/343e87a8d4fc8253fd81aeaf0dcc424b9dc4eda7 https://github.com/Combodo/iTop/commit/89145593ef2e077529a6f7ee7cde712db637e1ab https://github.com/Combodo/iTop/security/advisories/GHSA-323r-chx5-m9gm https://www.synacktiv.com/advisories/file-read-in-itop • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-47488
https://notcve.org/view.php?id=CVE-2023-47488
Cross Site Scripting vulnerability in Combodo iTop v.3.1.0-2-11973 allows a local attacker to obtain sensitive information via a crafted script to the attrib_manager_id parameter in the General Information page and the id parameter in the contact page. Vulnerabilidad de Cross-Site Scripting en Combodo iTop v.3.1.0-2-11973 permite a un atacante local obtener información sensible a través de un script manipulado para el parámetro attrib_manager_id en la página de información general y el parámetro id en la página de contacto. • https://github.com/nitipoom-jar/CVE-2023-47488 https://bugplorer.github.io/cve-xss-itop https://nitipoom-jar.github.io/CVE-2023-47488 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •