PT-2021-9740 · Comodo+1 · Itop+1

Antoine Vacher + 1 · Published 2021-01-13 · Updated 2024-04-04 · CVE-2020-15220

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 2.7.2 Combodo iTop versions prior to 3.0.0

Description The issue concerns a web-based IT Service Management tool where two cookies are created for the same session, potentially allowing user session theft.

Recommendations For versions prior to 2.7.2, update to version 2.7.2 or later to resolve the issue. For versions prior to 3.0.0, update to version 3.0.0 or later to resolve the issue.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

ALT-PU-2023-1879

ALT-PU-2024-4537

ALT-PU-2024-4547

ALT-PU-2024-4961

CVE-2020-15220

GHSA-QW4Q-CMCV-7VV2

Affected Products

Alt Linux

Itop

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-15220 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15220 · Vendor Advisory
• https://github.com/Combodo/iTop/security/advisories/GHSA-qw4q-cmcv-7vv2 · Note