CVE-2023-48710

combodo itop

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2023-48710

Katalog CVE

CVSS 9.8 · Critical EPSS 0,72%

Kerentanan Files or Directories Accessible to External Parties pada combodo itop. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted access. Hopefully, there is no sensitive files stored in that folder natively, but there could be from a third-party module. The `pages/exec.php` script as been fixed to limit execution of PHP files only. Other file types won't be retrieved and exposed. The vulnerability is fixed in 2.7.10, 3.0.4, 3.1.1, and 3.2.0.

Rincian

Terbit di NVD
15 April 2024
Terakhir diubah
17 Juni 2026
Status NVD
Analyzed
CVSS 3.1
9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-552: Files or Directories Accessible to External Parties
EPSS (30 hari)
0,72% peluang dieksploitasi; lebih tinggi dari 52,6% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
combodo itop Semua versi sebelum 2.7.10
combodo itop Versi 3.0.0 hingga sebelum 3.0.4
combodo itop Versi 3.1.0 hingga sebelum 3.1.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.