CVE-2023-38511

medium

Description

iTop is an IT service management platform. Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnerability is fixed in 3.0.4 and 3.1.1.

References

https://www.synacktiv.com/advisories/file-read-in-itop

https://github.com/Combodo/iTop/security/advisories/GHSA-323r-chx5-m9gm

https://github.com/Combodo/iTop/commit/89145593ef2e077529a6f7ee7cde712db637e1ab

https://github.com/Combodo/iTop/commit/343e87a8d4fc8253fd81aeaf0dcc424b9dc4eda7

Details

Source: Mitre, NVD

Published: 2024-04-15

Updated: 2025-02-06

Risk Information

CVSS v2

Base Score: 4

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 4.3

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N