CVE-2020-4079CWE-200

Information disclosure vulnerability in iTop

High · published January 12, 2021

CVSS v3.1
7.7
EPSS
1%
Percentile
58.5
In the wild
Unconfirmed
What it is

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access data they which they should not have access to. This is fixed in versions 2.7.2 and 3.0.0.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00872 · 58.5th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2021-01-12T19:20Z
EPSS history
Timeline
  • 12 JAN 19:20Z
    Information disclosure vulnerability in iTop
    cvelistv5