PT-2024-13409 · Itop+1 · Itop+1

Nguyễn Hữu Cường · Published 2024-01-04 · Updated 2025-02-06 · CVE-2023-47123

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions iTop versions prior to 3.1.1 iTop versions prior to 3.2.0

Description The issue allows an XSS attack to be performed when an object is displayed as an n:n relation item in another object, by filling malicious code in an object friendlyname or complementary name.

Recommendations For versions prior to 3.1.1, update to version 3.1.1 or later to resolve the issue. For versions prior to 3.2.0, update to version 3.2.0 or later to resolve the issue. As a temporary workaround, consider restricting the input for object friendlyname and complementary name fields to prevent malicious code injection until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2024-1028

ALT-PU-2024-4537

ALT-PU-2024-4547

ALT-PU-2024-4961

CVE-2023-47123

GHSA-MX8X-693W-9HJP

Affected Products

Alt Linux

Itop

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47123.json · Exploit
• https://github.com/Combodo/iTop/security/advisories/GHSA-mx8x-693w-9hjp · Vendor Advisory
• https://github.com/Combodo/iTop/commit/34ba4fa0ce99534f751d9f170fe0eda103e20c72 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-47123 · Security Note
• https://osv.dev/vulnerability/CVE-2023-47123 · Vendor Advisory
• https://t.me/cvenotify/76848 · Telegram Post
• https://t.me/cvenotify/110291 · Telegram Post
• https://t.me/cvenotify/76826 · Telegram Post
• https://twitter.com/CVEnew/status/1779930843504369909 · Twitter Post