CVE-2019-11215: XSS
In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader with a maliciously crafted payload. Many conditions can place the configuration file into a writable state: during installation; during upgrade; in certain cases, an error during modification of the file from the web interface leaves the file writable (can be triggered with XSS); a race condition can be triggered by the hub-connector module (community version only from 2.4.1 to 2.6.0); or editing the file in a CLI.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-11215?
CVE-2019-11215 is a vulnerability in Combodo iTop versions 2.2.0 through 2.6.0 that allows for the execution of arbitrary code if the configuration file is writable.
How severe is CVE-2019-11215?
CVE-2019-11215 has a severity rating of 8.1, which is considered high.
How can the configuration file become writable in Combodo iTop?
The configuration file in Combodo iTop can become writable during installation, upgrade, or under certain conditions.
What can an attacker accomplish with CVE-2019-11215?
An attacker exploiting CVE-2019-11215 can execute arbitrary code by calling ajax.dataloader with a maliciously crafted payload.
Are there any fixes or patches available for CVE-2019-11215?
It is recommended to update to a version of Combodo iTop that is not affected by CVE-2019-11215. Refer to the official iTop website for the latest releases and patches.