PT-2024-13138 · Itop+1 · Itop+1

Hainguyen0207 + 1 · Published 2024-01-04 · Updated 2025-03-14 · CVE-2023-43790

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions iTop versions prior to 3.1.1 iTop versions prior to 3.2.0

Description iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname value.

Recommendations For versions prior to 3.1.1, update to version 3.1.1 or later to resolve the issue. For versions prior to 3.2.0, update to version 3.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to HTTP queries that can manipulate the object friendlyname value until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

ALT-PU-2024-1028

ALT-PU-2024-4537

ALT-PU-2024-4547

ALT-PU-2024-4961

ALT-PU-2025-4212

CVE-2023-43790

GHSA-96XM-P83R-HM97

Affected Products

Alt Linux

Itop

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43790.json · Exploit
• https://github.com/Combodo/iTop/commit/03c9ffc0334fd44f3f0e82477264087064e1c732 · Patch
• https://github.com/Combodo/iTop/security/advisories/GHSA-96xm-p83r-hm97 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43790 · Security Note
• https://osv.dev/vulnerability/CVE-2023-43790 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1779943065660064003 · Twitter Post
• https://t.me/cvenotify/76845 · Telegram Post
• https://t.me/cvenotify/110288 · Telegram Post
• https://twitter.com/CVEnew/status/1779923651850121478 · Twitter Post
• https://t.me/cvenotify/76820 · Telegram Post