CVE-2023-45808 iTop missing silo check on extkey in console and portal
Attackers can bypass silo restrictions to create or modify objects referencing out-of-scope data in iTop ITSM platform.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-45808?
CVE-2023-45808 is a medium-severity missing authorization vulnerability in Combodo Itop, published on 15 Apr 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
iTop is an IT service management platform. When creating or updating an object, extkey values aren't checked to be in the current user silo. In other words, by forging an http request, the user can create objects pointing to out of silo objects (for example a UserRequest in an out of scope Organization). Fixed in iTop 2.7.10, 3.0.4, 3.1.1, and 3.2.0.
Weakness: CWE-639
Which versions are affected by CVE-2023-45808?
It affects 1 product.
Products include Combodo Itop.
How do I fix CVE-2023-45808?
No fix has been published for CVE-2023-45808 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-45808 being exploited?
There is no known exploitation of CVE-2023-45808 in the wild and no public exploit code.
Other vulnerabilities in Combodo Itop
- CVE-2023-48710 iTop limit pages/exec.php script to PHP files
- CVE-2022-39214 Authenticated users of Combodo iTop can take over any account
- CVE-2021-41161 XSS in csvimport in 3.0.0-beta versions
- CVE-2021-41162 Cross-site Scripting in Combodo iTop
- CVE-2025-47773 Combodo iTop has XSS vulnerability in /pages/ajax.render.php
Sources
Also known as GHSA-245j-66p9-pwmh.