CVE-2020-4079

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access data they which they should not have access to. This is fixed in versions 2.7.2 and 3.0.0.

CVSS v3 7.7 HIGH
CVSS v2.0 4.0 MEDIUM

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/Combodo/iTop/security/advisories/GHSA-vcv9-xp3j-7jwh	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:combodo:itop::::::::
	cpe:2.3:a:combodo:itop:2.7.3:::::::*

History

14 Jan 2021, 17:26

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 4.0 v3 : 7.7
References	~~(CONFIRM) https://github.com/Combodo/iTop/security/advisories/GHSA-vcv9-xp3j-7jwh -~~	(CONFIRM) https://github.com/Combodo/iTop/security/advisories/GHSA-vcv9-xp3j-7jwh - Third Party Advisory
CPE		cpe:2.3:a:combodo:itop:2.7.3:::::::* cpe:2.3:a:combodo:itop::::::::

12 Jan 2021, 20:24

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-01-12 20:15

Updated : 2023-12-10 13:41

NVD link : CVE-2020-4079

Mitre link : CVE-2020-4079

CVE.ORG link : CVE-2020-4079

JSON object : View

Products Affected

combodo

itop

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2020-4079", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "published": "2021-01-12T20:15:24.760", "references": [{"url": "https://github.com/Combodo/iTop/security/advisories/GHSA-vcv9-xp3j-7jwh", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the \"excel export\" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access data they which they should not have access to. This is fixed in versions 2.7.2 and 3.0.0."}, {"lang": "es", "value": "Combodo iTop es una herramienta de IT Service Management basada en la web. En iTop versiones anteriores a 2.7.2 y 2.8.0, cuando el endpoint ajax para la funcionalidad del portal \"excel export\" es llamado directamente, permite obtener datos sin filtrado de alcance. Esto permite a un usuario acceder a datos a los que no deber\u00eda tener acceso. Esto es corregido en las versiones 2.7.2 y 3.0.0"}], "lastModified": "2021-01-14T17:26:36.357", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "812ABDA6-D405-4617-8A76-47F606E43D38", "versionEndExcluding": "2.7.2"}, {"criteria": "cpe:2.3:a:combodo:itop:2.7.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "85FDA344-FD68-4265-A1B8-D3C901F83680"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}