OpenCVE

Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, a user who can log in on iTop is able to take over any account just by knowing the account's username. This issue is fixed in versions 2.7.8 and 3.0.2-1.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Combodo	Itop

Configuration 1 [-]

OR	cpe:2.3:a:combodo:itop::::::::
	cpe:2.3:a:combodo:itop::::::::

No data.

References

Link	Providers
https://github.com/Combodo/iTop/commit/4c1df9927d1dc6b0181ee20721f93346def026fd
https://github.com/Combodo/iTop/commit/bdebea62b642622ed71410b26c81e8537e6e58fa
https://github.com/Combodo/iTop/security/advisories/GHSA-vj96-j84g-jhx4

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-03-14T15:10:47.933Z

Updated: 2024-08-03T12:00:43.335Z

Reserved: 2022-09-02T14:16:35.821Z

Link: CVE-2022-39214

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-03-14T16:15:10.277

Modified: 2024-11-21T07:17:48.183

Link: CVE-2022-39214

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-39214", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2022-09-02T14:16:35.821Z", "datePublished": "2023-03-14T15:10:47.933Z", "dateUpdated": "2024-08-03T12:00:43.335Z"}, "containers": {"cna": {"title": "Authenticated users of Combodo iTop can take over any account", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Combodo/iTop/security/advisories/GHSA-vj96-j84g-jhx4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-vj96-j84g-jhx4"}, {"name": "https://github.com/Combodo/iTop/commit/4c1df9927d1dc6b0181ee20721f93346def026fd", "tags": ["x_refsource_MISC"], "url": "https://github.com/Combodo/iTop/commit/4c1df9927d1dc6b0181ee20721f93346def026fd"}, {"name": "https://github.com/Combodo/iTop/commit/bdebea62b642622ed71410b26c81e8537e6e58fa", "tags": ["x_refsource_MISC"], "url": "https://github.com/Combodo/iTop/commit/bdebea62b642622ed71410b26c81e8537e6e58fa"}], "affected": [{"vendor": "Combodo", "product": "iTop", "versions": [{"version": "< 2.7.8", "status": "affected"}, {"version": ">= 3.0.0, < 3.0.2-1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-03-14T15:10:47.933Z"}, "descriptions": [{"lang": "en", "value": "Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, a user who can log in on iTop is able to take over any account just by knowing the account's username. This issue is fixed in versions 2.7.8 and 3.0.2-1."}], "source": {"advisory": "GHSA-vj96-j84g-jhx4", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:00:43.335Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/Combodo/iTop/security/advisories/GHSA-vj96-j84g-jhx4", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-vj96-j84g-jhx4"}, {"name": "https://github.com/Combodo/iTop/commit/4c1df9927d1dc6b0181ee20721f93346def026fd", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Combodo/iTop/commit/4c1df9927d1dc6b0181ee20721f93346def026fd"}, {"name": "https://github.com/Combodo/iTop/commit/bdebea62b642622ed71410b26c81e8537e6e58fa", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Combodo/iTop/commit/bdebea62b642622ed71410b26c81e8537e6e58fa"}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*", "matchCriteriaId": "B6FFC841-DFF5-49DE-9B60-51CB5F979693", "versionEndExcluding": "2.7.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*", "matchCriteriaId": "BFD5F02C-2718-439E-AA59-6E1A0B18B024", "versionEndExcluding": "3.0.2-1", "versionStartExcluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, a user who can log in on iTop is able to take over any account just by knowing the account's username. This issue is fixed in versions 2.7.8 and 3.0.2-1."}], "id": "CVE-2022-39214", "lastModified": "2024-11-21T07:17:48.183", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-03-14T16:15:10.277", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Combodo/iTop/commit/4c1df9927d1dc6b0181ee20721f93346def026fd"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Combodo/iTop/commit/bdebea62b642622ed71410b26c81e8537e6e58fa"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-vj96-j84g-jhx4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/Combodo/iTop/commit/4c1df9927d1dc6b0181ee20721f93346def026fd"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/Combodo/iTop/commit/bdebea62b642622ed71410b26c81e8537e6e58fa"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-vj96-j84g-jhx4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}