CVE-2023-48709: iTop vulnerable to potential formula injection in Excel/CSV export file
iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas that may be imported into Excel. As Excel 2016 does not prevent Remote Code Execution by default, uninformed users may become victims. This vulnerability is fixed in 2.7.9, 3.0.4, 3.1.1, and 3.2.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-48709?
The severity of CVE-2023-48709 is classified as high due to the potential for remote code execution through malicious Excel formulas.
How do I fix CVE-2023-48709?
To fix CVE-2023-48709, upgrade iTop to the latest version that addresses this vulnerability, specifically beyond version 3.0.4.
Which versions of iTop are affected by CVE-2023-48709?
CVE-2023-48709 affects iTop versions up to 2.7.9 and versions from 3.0.0 up to 3.0.4, as well as specific versions in the 3.1.x series.
What is the impact of exploiting CVE-2023-48709?
Exploiting CVE-2023-48709 can allow an attacker to execute arbitrary code on a user's system when malicious data is imported from a CSV or Excel file.
Who is at risk from CVE-2023-48709?
Users of iTop who export data may be at risk from CVE-2023-48709 if they open affected files without proper security awareness.