CVE-2024-54139 - Vulnerability Details

Vendors	Products
Combodo	Itop

Link	Providers
https://github.com/Combodo/iTop/security/advisories/GHSA-jmv2-wfh5-h5wg

Type	Values Removed	Values Added
First Time appeared		Combodo Combodo itop
CPEs		cpe:2.3:a:combodo:itop:::::::: cpe:2.3:a:combodo:itop:3.2.0:alpha1:::::: cpe:2.3:a:combodo:itop:3.2.0:beta1:::::: cpe:2.3:a:combodo:itop:3.2.0:rc1:::::: cpe:2.3:a:combodo:itop:3.2.0:rc2:::::: cpe:2.3:a:combodo:itop:3.2.0:rc3::::::
Vendors & Products		Combodo Combodo itop

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Title		Combodo iTop vulnerable to XSS leading to CSRF breach on _table_id parameter

Type	Values Removed	Values Added
Description		Combodo iTop is an open source and web-based IT service management platform. Prior to versions 2.7.11, 3.1.2, and 3.2.0., iTop has a cross-site scripting vulnerability that can lead to cross-site request forgery on the `_table_id` parameter. Versions 2.7.11, 3.1.2, and 3.2.0 contain a patch for the issue.
Weaknesses		CWE-352 CWE-79
References		https://github.com/Combodo/iTop/security/advisories/GHSA-jmv2-wfh5-h5wg
Metrics		cvssV3_1 `{'score': 7.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-54139", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-11-29T18:02:16.755Z", "datePublished": "2024-12-13T15:59:24.978Z", "dateUpdated": "2024-12-13T17:34:07.288Z"}, "containers": {"cna": {"title": "Combodo iTop vulnerable to XSS leading to CSRF breach on _table_id parameter", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.9, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/Combodo/iTop/security/advisories/GHSA-jmv2-wfh5-h5wg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-jmv2-wfh5-h5wg"}], "affected": [{"vendor": "Combodo", "product": "iTop", "versions": [{"version": "< 2.7.11", "status": "affected"}, {"version": ">= 3.0.0-alpha, < 3.1.2", "status": "affected"}, {"version": ">= 3.2.0-alpha1, < 3.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-12-13T15:59:24.978Z"}, "descriptions": [{"lang": "en", "value": "Combodo iTop is an open source and web-based IT service management platform. Prior to versions 2.7.11, 3.1.2, and 3.2.0., iTop has a cross-site scripting vulnerability that can lead to cross-site request forgery on the `_table_id` parameter. Versions 2.7.11, 3.1.2, and 3.2.0 contain a patch for the issue."}], "source": {"advisory": "GHSA-jmv2-wfh5-h5wg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-13T17:33:51.255770Z", "id": "CVE-2024-54139", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-13T17:34:07.288Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-54139 (string)

assignerOrgId : a0819718-46f1-4df5-94e2-005712e83aaa (string)

state : PUBLISHED (string)

assignerShortName : GitHub_M (string)

dateReserved : 2024-11-29T18:02:16.755Z (string)

datePublished : 2024-12-13T15:59:24.978Z (string)

dateUpdated : 2024-12-13T17:34:07.288Z (string)

}

containers : { »

cna : { »

title : Combodo iTop vulnerable to XSS leading to CSRF breach on _table_id parameter (string)

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-79 (string)

lang : en (string)

description : CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (string)

type : CWE (string)

}

]

}

1 : { »

descriptions : [ »

0 : { »

cweId : CWE-352 (string)

lang : en (string)

description : CWE-352: Cross-Site Request Forgery (CSRF) (string)

type : CWE (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 7.9 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L (string)

version : 3.1 (string)

}

]

references : [ »

0 : { »

name : https://github.com/Combodo/iTop/security/advisories/GHSA-jmv2-wfh5-h5wg (string)

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://github.com/Combodo/iTop/security/advisories/GHSA-jmv2-wfh5-h5wg (string)

}

]

affected : [ »

0 : { »

vendor : Combodo (string)

product : iTop (string)

versions : [ »

0 : { »

version : < 2.7.11 (string)

status : affected (string)

}

1 : { »

version : >= 3.0.0-alpha, < 3.1.2 (string)

status : affected (string)

}

2 : { »

version : >= 3.2.0-alpha1, < 3.2.0 (string)

status : affected (string)

}

]

}

]

providerMetadata : { »

orgId : a0819718-46f1-4df5-94e2-005712e83aaa (string)

shortName : GitHub_M (string)

dateUpdated : 2024-12-13T15:59:24.978Z (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Combodo iTop is an open source and web-based IT service management platform. Prior to versions 2.7.11, 3.1.2, and 3.2.0., iTop has a cross-site scripting vulnerability that can lead to cross-site request forgery on the `_table_id` parameter. Versions 2.7.11, 3.1.2, and 3.2.0 contain a patch for the issue. (string)

}

]

source : { »

advisory : GHSA-jmv2-wfh5-h5wg (string)

discovery : UNKNOWN (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-12-13T17:33:51.255770Z (string)

id : CVE-2024-54139 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-12-13T17:34:07.288Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-54139", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-12-13T17:33:51.255770Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-13T17:34:02.429Z"}}], "cna": {"title": "Combodo iTop vulnerable to XSS leading to CSRF breach on _table_id parameter", "source": {"advisory": "GHSA-jmv2-wfh5-h5wg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.9, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Combodo", "product": "iTop", "versions": [{"status": "affected", "version": "< 2.7.11"}, {"status": "affected", "version": ">= 3.0.0-alpha, < 3.1.2"}, {"status": "affected", "version": ">= 3.2.0-alpha1, < 3.2.0"}]}], "references": [{"url": "https://github.com/Combodo/iTop/security/advisories/GHSA-jmv2-wfh5-h5wg", "name": "https://github.com/Combodo/iTop/security/advisories/GHSA-jmv2-wfh5-h5wg", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Combodo iTop is an open source and web-based IT service management platform. Prior to versions 2.7.11, 3.1.2, and 3.2.0., iTop has a cross-site scripting vulnerability that can lead to cross-site request forgery on the `_table_id` parameter. Versions 2.7.11, 3.1.2, and 3.2.0 contain a patch for the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-12-13T15:59:24.978Z"}}}, "cveMetadata": {"cveId": "CVE-2024-54139", "state": "PUBLISHED", "dateUpdated": "2024-12-13T17:34:07.288Z", "dateReserved": "2024-11-29T18:02:16.755Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-12-13T15:59:24.978Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-54139 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-12-13T17:33:51.255770Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-12-13T17:34:02.429Z (string)

}

]

cna : { »

title : Combodo iTop vulnerable to XSS leading to CSRF breach on _table_id parameter (string)

source : { »

advisory : GHSA-jmv2-wfh5-h5wg (string)

discovery : UNKNOWN (string)

}

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : CHANGED (string)

version : 3.1 (string)

baseScore : 7.9 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L (string)

integrityImpact : HIGH (string)

userInteraction : REQUIRED (string)

attackComplexity : HIGH (string)

availabilityImpact : LOW (string)

privilegesRequired : LOW (string)

confidentialityImpact : HIGH (string)

}

]

affected : [ »

0 : { »

vendor : Combodo (string)

product : iTop (string)

versions : [ »

0 : { »

status : affected (string)

version : < 2.7.11 (string)

}

1 : { »

status : affected (string)

version : >= 3.0.0-alpha, < 3.1.2 (string)

}

2 : { »

status : affected (string)

version : >= 3.2.0-alpha1, < 3.2.0 (string)

}

]

}

]

references : [ »

0 : { »

url : https://github.com/Combodo/iTop/security/advisories/GHSA-jmv2-wfh5-h5wg (string)

name : https://github.com/Combodo/iTop/security/advisories/GHSA-jmv2-wfh5-h5wg (string)

tags : [ »

0 : x_refsource_CONFIRM (string)

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Combodo iTop is an open source and web-based IT service management platform. Prior to versions 2.7.11, 3.1.2, and 3.2.0., iTop has a cross-site scripting vulnerability that can lead to cross-site request forgery on the `_table_id` parameter. Versions 2.7.11, 3.1.2, and 3.2.0 contain a patch for the issue. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-79 (string)

description : CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (string)

}

]

}

1 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-352 (string)

description : CWE-352: Cross-Site Request Forgery (CSRF) (string)

}

]

}

]

providerMetadata : { »

orgId : a0819718-46f1-4df5-94e2-005712e83aaa (string)

shortName : GitHub_M (string)

dateUpdated : 2024-12-13T15:59:24.978Z (string)

}

cveMetadata : { »

cveId : CVE-2024-54139 (string)

state : PUBLISHED (string)

dateUpdated : 2024-12-13T17:34:07.288Z (string)

dateReserved : 2024-11-29T18:02:16.755Z (string)

assignerOrgId : a0819718-46f1-4df5-94e2-005712e83aaa (string)

datePublished : 2024-12-13T15:59:24.978Z (string)

assignerShortName : GitHub_M (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*", "matchCriteriaId": "1BF82095-AA7D-454F-9228-78EC4D8CD5CE", "versionEndExcluding": "2.7.11", "vulnerable": true}, {"criteria": "cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*", "matchCriteriaId": "91456038-80B6-479B-BBDF-9376B9D2F100", "versionEndExcluding": "3.1.2", "versionStartIncluding": "3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:combodo:itop:3.2.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "C62AC350-F938-43A2-B066-3CEF23B03C0C", "vulnerable": true}, {"criteria": "cpe:2.3:a:combodo:itop:3.2.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "B2E2A04B-A0E6-4906-BD91-91DAC92CC067", "vulnerable": true}, {"criteria": "cpe:2.3:a:combodo:itop:3.2.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "24D309D2-E86C-4222-B258-C09BEEF42CD2", "vulnerable": true}, {"criteria": "cpe:2.3:a:combodo:itop:3.2.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "6613DB9B-E3F9-44CC-B46A-77739060B641", "vulnerable": true}, {"criteria": "cpe:2.3:a:combodo:itop:3.2.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "5C86A4B5-375A-4761-A853-AB0EED54A540", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Combodo iTop is an open source and web-based IT service management platform. Prior to versions 2.7.11, 3.1.2, and 3.2.0., iTop has a cross-site scripting vulnerability that can lead to cross-site request forgery on the `_table_id` parameter. Versions 2.7.11, 3.1.2, and 3.2.0 contain a patch for the issue."}, {"lang": "es", "value": "Combodo iTop es una plataforma de gesti\u00f3n de servicios de TI basada en la web y de c\u00f3digo abierto. En versiones anteriores a las 2.7.11, 3.1.2 y 3.2.0, iTop presenta una vulnerabilidad de cross-site scripting que puede provocar cross-site request forgery en el par\u00e1metro `_table_id`. Las versiones 2.7.11, 3.1.2 y 3.2.0 contienen un parche para solucionar el problema."}], "id": "CVE-2024-54139", "lastModified": "2025-03-11T16:44:20.720", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.9, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-12-13T16:15:26.210", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/Combodo/iTop/security/advisories/GHSA-jmv2-wfh5-h5wg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 1BF82095-AA7D-454F-9228-78EC4D8CD5CE (string)

versionEndExcluding : 2.7.11 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 91456038-80B6-479B-BBDF-9376B9D2F100 (string)

versionEndExcluding : 3.1.2 (string)

versionStartIncluding : 3.0.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:combodo:itop:3.2.0:alpha1:*:*:*:*:*:* (string)

matchCriteriaId : C62AC350-F938-43A2-B066-3CEF23B03C0C (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:combodo:itop:3.2.0:beta1:*:*:*:*:*:* (string)

matchCriteriaId : B2E2A04B-A0E6-4906-BD91-91DAC92CC067 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:combodo:itop:3.2.0:rc1:*:*:*:*:*:* (string)

matchCriteriaId : 24D309D2-E86C-4222-B258-C09BEEF42CD2 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:combodo:itop:3.2.0:rc2:*:*:*:*:*:* (string)

matchCriteriaId : 6613DB9B-E3F9-44CC-B46A-77739060B641 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:combodo:itop:3.2.0:rc3:*:*:*:*:*:* (string)

matchCriteriaId : 5C86A4B5-375A-4761-A853-AB0EED54A540 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Combodo iTop is an open source and web-based IT service management platform. Prior to versions 2.7.11, 3.1.2, and 3.2.0., iTop has a cross-site scripting vulnerability that can lead to cross-site request forgery on the `_table_id` parameter. Versions 2.7.11, 3.1.2, and 3.2.0 contain a patch for the issue. (string)

}

1 : { »

lang : es (string)

value : Combodo iTop es una plataforma de gestión de servicios de TI basada en la web y de código abierto. En versiones anteriores a las 2.7.11, 3.1.2 y 3.2.0, iTop presenta una vulnerabilidad de cross-site scripting que puede provocar cross-site request forgery en el parámetro `_table_id`. Las versiones 2.7.11, 3.1.2 y 3.2.0 contienen un parche para solucionar el problema. (string)

}

]

id : CVE-2024-54139 (string)

lastModified : 2025-03-11T16:44:20.720 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 7.9 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L (string)

version : 3.1 (string)

}

exploitabilityScore : 1.3 (number)

impactScore : 6 (number)

source : security-advisories@github.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.6 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2024-12-13T16:15:26.210 (string)

references : [ »

0 : { »

source : security-advisories@github.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://github.com/Combodo/iTop/security/advisories/GHSA-jmv2-wfh5-h5wg (string)

}

]

sourceIdentifier : security-advisories@github.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

1 : { »

lang : en (string)

value : CWE-352 (string)

}

]

source : security-advisories@github.com (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : nvd@nist.gov (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object