Описание
Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary commands by changing the platform configuration, because web/env-production/itop-config/config.php contains a function called TestConfig() that calls the vulnerable function eval().
Ссылки
- ExploitThird Party Advisory
- Issue Tracking
- ExploitThird Party Advisory
- Issue Tracking
Уязвимые конфигурации
Конфигурация 1Версия до 2.4.1 (включая)
cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*
EPSS
Процентиль: 88%
0.03801
Низкий
7.2 High
CVSS3
6.5 Medium
CVSS2
Дефекты
CWE-94
Связанные уязвимости
CVSS3: 7.2
github
больше 3 лет назад
Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary commands by changing the platform configuration, because web/env-production/itop-config/config.php contains a function called TestConfig() that calls the vulnerable function eval().
EPSS
Процентиль: 88%
0.03801
Низкий
7.2 High
CVSS3
6.5 Medium
CVSS2
Дефекты
CWE-94