Vulnerability CVE-2023-38511: Information

Description

iTop is an IT service management platform. Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnerability is fixed in 3.0.4 and 3.1.1.

Severity: MEDIUM (4.3)

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2023-38511

Published: April 15, 2024

Modified: Feb. 6, 2025

Error type identifier: CWE-22

Fixed packages

Package name	Branch	Fixed in version	Version from repository	Errata ID	Task #	State
itop	sisyphus	3.1.1.1-alt1	3.2.2-alt2	ALT-PU-2024-1028-2	337677	Fixed
itop	sisyphus_e2k	3.1.1.1-alt1	3.1.1.1-alt1	ALT-PU-2024-1071-1	-	Fixed
itop	sisyphus_loongarch64	3.1.1.1-alt1	3.2.2-alt2	ALT-PU-2024-1042-1	-	Fixed
itop	p11	3.1.1.1-alt1	3.1.1.1-alt1	ALT-PU-2024-1028-2	337677	Fixed
itop	p10	3.1.1.1-alt1	3.1.1.1-alt1	ALT-PU-2024-4537-3	343613	Fixed
itop	p10_e2k	3.1.1.1-alt1	3.1.1.1-alt1	ALT-PU-2024-4805-1	-	Fixed
itop	c10f2	3.1.1.1-alt1	3.2.2-alt1	ALT-PU-2024-4549-3	343622	Fixed
itop	c9f2	3.1.1.1-alt1	3.2.0.2-alt0.c9f2.1	ALT-PU-2024-4547-3	343621	Fixed

References to Advisories, Solutions, and Tools

Hyperlink	Resource
https://github.com/Combodo/iTop/commit/343e87a8d4fc8253fd81aeaf0dcc424b9dc4eda7	Patch
https://github.com/Combodo/iTop/commit/89145593ef2e077529a6f7ee7cde712db637e1ab	Patch
https://github.com/Combodo/iTop/security/advisories/GHSA-323r-chx5-m9gm	Vendor Advisory
https://www.synacktiv.com/advisories/file-read-in-itop	Exploit Third Party Advisory
BDU:2024-03294

Affected configurations:
1. cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*
  Start including
  3.0.0
  End excluding
  3.0.4
  cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*
  Start including
  3.1.0
  End excluding
  3.1.1

Version: v26.2.2