CVEvulnerability

CVE-2019-11215

8.1 HIGH Published 2020-02-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-02-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-362, CWE-732, CWE-79

Description

In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader with a maliciously crafted payload. Many conditions can place the configuration file into a writable state: during installation; during upgrade; in certain cases, an error during modification of the file from the web interface leaves the file writable (can be triggered with XSS); a race condition can be triggered by the hub-connector module (community version only from 2.4.1 to 2.6.0); or editing the file in a CLI.

Affected configurations

• combodo itop (>= 2.2.0 <= 2.4.0) • combodo itop (>= 2.4.1 <= 2.6.0)

Related

Weakness · CWE (3)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References