CVE-2024-31448

Combodo iTop is a simple, web based IT Service Management tool. By filling malicious code in a CSV content, an Cross-site Scripting (XSS) attack can be performed when importing this content. This issue has been fixed in versions 3.1.2 and 3.2.0. All users are advised to upgrade. Users unable to upgrade should validate CSV content before importing it.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/Combodo/iTop/security/advisories/GHSA-776w-x6v7-vfwf	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*

History

06 Nov 2024, 14:31

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~8.8~~	v2 : unknown v3 : 6.1
References	~~() https://github.com/Combodo/iTop/security/advisories/GHSA-776w-x6v7-vfwf -~~	() https://github.com/Combodo/iTop/security/advisories/GHSA-776w-x6v7-vfwf - Vendor Advisory
First Time		Combodo Combodo itop
CPE		cpe:2.3:a:combodo:itop::::::::

05 Nov 2024, 16:04

Type	Values Removed	Values Added
Summary		(es) Combodo iTop es una herramienta de gestión de servicios de TI sencilla y basada en la web. Al introducir un código malicioso en un contenido CSV, se puede realizar un ataque de cross site scripting (XSS) al importar este contenido. Este problema se ha solucionado en las versiones 3.1.2 y 3.2.0. Se recomienda a todos los usuarios que actualicen la versión. Los usuarios que no puedan actualizar la versión deben validar el contenido CSV antes de importarlo.

05 Nov 2024, 00:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-11-05 00:15

Updated : 2024-11-06 14:31

NVD link : CVE-2024-31448

Mitre link : CVE-2024-31448

CVE.ORG link : CVE-2024-31448

JSON object : View

Products Affected

combodo

itop

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-31448", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2024-11-05T00:15:03.860", "references": [{"url": "https://github.com/Combodo/iTop/security/advisories/GHSA-776w-x6v7-vfwf", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Combodo iTop is a simple, web based IT Service Management tool. By filling malicious code in a CSV content, an Cross-site Scripting (XSS) attack can be performed when importing this content. This issue has been fixed in versions 3.1.2 and 3.2.0. All users are advised to upgrade. Users unable to upgrade should validate CSV content before importing it."}, {"lang": "es", "value": " Combodo iTop es una herramienta de gesti\u00f3n de servicios de TI sencilla y basada en la web. Al introducir un c\u00f3digo malicioso en un contenido CSV, se puede realizar un ataque de cross site scripting (XSS) al importar este contenido. Este problema se ha solucionado en las versiones 3.1.2 y 3.2.0. Se recomienda a todos los usuarios que actualicen la versi\u00f3n. Los usuarios que no puedan actualizar la versi\u00f3n deben validar el contenido CSV antes de importarlo."}], "lastModified": "2024-11-06T14:31:08.877", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B1E5E6E-1398-4908-9D8F-25C8C667F3D2", "versionEndExcluding": "3.1.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}