PT-2020-9419 · Itop+1 · Itop+1

Published 2019-04-16 · Updated 2020-08-24 · CVE-2019-13967

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: iTop versions 2.2.0 through 2.6.0

Description: The issue allows remote attackers to cause a denial of service, resulting in an application outage. This is achieved by sending many requests to launch a compile operation, specifically targeting the "pages/exec.php?exec env=production&exec module=itop-hub-connector&exec page=ajax.php&operation=compile" API endpoint. It is noted that this only affects the community version of the software.

Recommendations: For versions 2.2.0 through 2.6.0, consider restricting access to the "pages/exec.php" API endpoint to prevent excessive compile operation requests as a temporary workaround.

Fix

Related Identifiers

ALT-PU-2019-1658

CVE-2019-13967

Affected Products

Alt Linux

Itop

References · 4

• https://osv.dev/vulnerability/CVE-2019-13967 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13967 · Security Note
• https://itophub.io/wiki/page?id=latest%3Arelease%3Achange_log · Note
• https://0day.love/itop_vulnerabilities_disclosure.pdf · Note