PT-2021-9738 · Comodo+1 · Combodo Itop+1

Antoine Vacher + 1 · Published 2021-01-13 · Updated 2024-04-04 · CVE-2020-15218

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 2.7.2 Combodo iTop versions prior to 3.0.0

Description The issue concerns the caching of admin pages in Combodo iTop, allowing their content to be visible after disconnection by using the browser back button.

Recommendations For versions prior to 2.7.2, update to version 2.7.2 or later. For versions prior to 3.0.0, update to version 3.0.0 or later.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

ALT-PU-2023-1879

ALT-PU-2024-4537

ALT-PU-2024-4547

ALT-PU-2024-4961

CVE-2020-15218

GHSA-3M3G-86HP-5P2J

Affected Products

Alt Linux

Combodo Itop

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-15218 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15218 · Vendor Advisory
• https://github.com/Combodo/iTop/security/advisories/GHSA-3m3g-86hp-5p2j · Note