CVE-2024-51993CWE-312

Password is stored in clear in the database in Combodo iTop

Low · published November 7, 2024

CVSS v3.0
3.4
EPSS
0%
Percentile
1.3
In the wild
Unconfirmed
What it is

Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for misconfigured Users. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. Users unable to upgrade are advised to encrypt their backups independently of the iTop application.

### Patches

Sanitize parameter

### References

N°7631 - Password is stored in clear in the database.

The record
Technical detail
CVSS v3.0
3.4 · LOW
Vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00111 · 1.3th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2024-11-07T17:59Z
EPSS history
Timeline
  • 07 NOV 17:59Z
    Password is stored in clear in the database in Combodo iTop
    cvelistv5