Описание
Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary commands by changing the platform configuration, because web/env-production/itop-config/config.php contains a function called TestConfig() that calls the vulnerable function eval().
Ссылки
- ExploitThird Party Advisory
- Issue Tracking
- ExploitThird Party Advisory
- Issue Tracking
Уязвимые конфигурации
Конфигурация 1Версия до 2.4.1 (включая)
cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*
EPSS
Процентиль: 94%
0.07381
Низкий
7.2 High
CVSS3
6.5 Medium
CVSS2
Дефекты
CWE-94
Связанные уязвимости
CVSS3: 7.2
github
больше 4 лет назад
Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary commands by changing the platform configuration, because web/env-production/itop-config/config.php contains a function called TestConfig() that calls the vulnerable function eval().
CVSS3: 7.2
altlinux
больше 7 лет назад
ALT-PU-2019-1356: package `itop` update to version 2.6.0-alt1
EPSS
Процентиль: 94%
0.07381
Низкий
7.2 High
CVSS3
6.5 Medium
CVSS2
Дефекты
CWE-94