CVE-2023-48709: iTop vulnerable to potential formula injection in Excel/CSV export file
First published: Mon Apr 15 2024(Updated: )
iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas that may be imported into Excel. As Excel 2016 does **not** prevent Remote Code Execution by default, uninformed users may become victims. This vulnerability is fixed in 2.7.9, 3.0.4, 3.1.1, and 3.2.0.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| iTop | <2.7.9>=3.0.0<=3.0.4>=3.1.0<=3.1.1>=3.2.0<=3.2.0 | |
| iTop | <2.7.9 | |
| iTop | >=3.0.0<3.0.4 | |
| iTop | >=3.1.0<3.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-48709?
The severity of CVE-2023-48709 is classified as high due to the potential for remote code execution through malicious Excel formulas.
How do I fix CVE-2023-48709?
To fix CVE-2023-48709, upgrade iTop to the latest version that addresses this vulnerability, specifically beyond version 3.0.4.
Which versions of iTop are affected by CVE-2023-48709?
CVE-2023-48709 affects iTop versions up to 2.7.9 and versions from 3.0.0 up to 3.0.4, as well as specific versions in the 3.1.x series.
What is the impact of exploiting CVE-2023-48709?
Exploiting CVE-2023-48709 can allow an attacker to execute arbitrary code on a user's system when malicious data is imported from a CSV or Excel file.
Who is at risk from CVE-2023-48709?
Users of iTop who export data may be at risk from CVE-2023-48709 if they open affected files without proper security awareness.
- agent/title
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/event
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- vendor/combodo
- canonical/itop
- version/itop/3.0.0
- version/itop/3.1.0