CVE-2023-45808: iTop missing silo check on extkey in console and portal
iTop is an IT service management platform. When creating or updating an object, extkey values aren't checked to be in the current user silo. In other words, by forging an http request, the user can create objects pointing to out of silo objects (for example a UserRequest in an out of scope Organization). Fixed in iTop 2.7.10, 3.0.4, 3.1.1, and 3.2.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-45808?
The severity of CVE-2023-45808 is classified as high due to the potential for unauthorized access to user requests outside of the current user's silo.
How do I fix CVE-2023-45808?
To fix CVE-2023-45808, upgrade to iTop version 3.2.0 or later, or apply the specific patches provided in the security advisories.
What systems are affected by CVE-2023-45808?
CVE-2023-45808 affects Combodo iTop versions prior to 3.2.0 and those between versions 3.0.4 and 2.7.10.
Can CVE-2023-45808 be exploited remotely?
Yes, CVE-2023-45808 can be exploited remotely by forging HTTP requests which can create or modify objects linked to out-of-silo data.
Is user authentication sufficient to mitigate CVE-2023-45808?
No, standard user authentication is not sufficient to mitigate CVE-2023-45808 because the vulnerability allows unauthorized object creation or updates.