Description (CNA)
iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to object fields when they're not supposed to. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Combodo / iTop | affected < 2.7.12; affected >= 3.0.0, < 3.1.3; affected >= 3.2.0, < 3.2.1 |
CWE
CWE-862
References
- https://github.com/Combodo/iTop/security/advisories/GHSA-c8hm-h9gv-8jpj
- https://github.com/Combodo/iTop/commit/44290db312901fc5918cc537c74561487fb3713b
ADP enrichment
No English description supplied.
No references supplied.