{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify information with administrative privileges by not following the HTTP Location header in server responses. This is fixed in all iTop packages (community, essential, professional) in versions : 2.5.4, 2.6.3, 2.7.0"}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-04-02T17:11:30", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.combodo.com/itop-193"}, {"tags": ["x_refsource_MISC"], "url": "https://www.pentagrid.ch/de/blog/security_issues_in_teampasswordmanager_and_combodo_itop/"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-2gfp-2qvh-9796"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-19821", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify information with administrative privileges by not following the HTTP Location header in server responses. This is fixed in all iTop packages (community, essential, professional) in versions : 2.5.4, 2.6.3, 2.7.0"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://www.combodo.com/itop-193", "refsource": "MISC", "url": "https://www.combodo.com/itop-193"}, {"name": "https://www.pentagrid.ch/de/blog/security_issues_in_teampasswordmanager_and_combodo_itop/", "refsource": "MISC", "url": "https://www.pentagrid.ch/de/blog/security_issues_in_teampasswordmanager_and_combodo_itop/"}, {"name": "https://github.com/Combodo/iTop/security/advisories/GHSA-2gfp-2qvh-9796", "refsource": "MISC", "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-2gfp-2qvh-9796"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T02:25:12.773Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.combodo.com/itop-193"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.pentagrid.ch/de/blog/security_issues_in_teampasswordmanager_and_combodo_itop/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-2gfp-2qvh-9796"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-19821", "datePublished": "2020-03-16T17:15:50", "dateReserved": "2019-12-16T00:00:00", "dateUpdated": "2024-08-05T02:25:12.773Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*", "matchCriteriaId": "849DE111-E559-4716-A58F-7B05F7CD7E60", "versionEndExcluding": "2.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify information with administrative privileges by not following the HTTP Location header in server responses. This is fixed in all iTop packages (community, essential, professional) in versions : 2.5.4, 2.6.3, 2.7.0"}, {"lang": "es", "value": "Una escalada de privilegios posterior a la autenticaci\u00f3n en la aplicaci\u00f3n web de Combodo iTop permite a los usuarios autenticados regulares acceder a la informaci\u00f3n y modificarla con privilegios administrativos al no seguir el encabezado HTTP Location en las respuestas del servidor. Esto se soluciona en todos los paquetes iTop (comunidad, esencial, profesional) en las versiones: 2.5.4, 2.6.3, 2.7.0."}], "id": "CVE-2019-19821", "lastModified": "2020-08-24T17:37:01.140", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 5.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-03-16T18:15:12.103", "references": [{"source": "cve@mitre.org", "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-2gfp-2qvh-9796"}, {"source": "cve@mitre.org", "tags": ["Product", "Vendor Advisory"], "url": "https://www.combodo.com/itop-193"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://www.pentagrid.ch/de/blog/security_issues_in_teampasswordmanager_and_combodo_itop/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}