CVE-2023-43790

moderate-risk

Published 2024-04-15

iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname value. This vulnerability is fixed in 3.1.1 and 3.2.0.

Do I need to act?

0.78% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.7/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Itop

Affected Vendors

Combodo

References (4)

Patch https://github.com/Combodo/iTop/commit/03c9ffc0334fd44f3f0e82477264087064e1c732

Vendor Advisory https://github.com/Combodo/iTop/security/advisories/GHSA-96xm-p83r-hm97

Patch https://github.com/Combodo/iTop/commit/03c9ffc0334fd44f3f0e82477264087064e1c732

Vendor Advisory https://github.com/Combodo/iTop/security/advisories/GHSA-96xm-p83r-hm97

/ 100

moderate-risk

Severity 22/34 · High

Exploitability 3/34 · Minimal

Exposure 5/34 · Minimal