CVE-2024-51993: Password is stored in clear in the database in Combodo iTop
First published: Thu Nov 07 2024(Updated: )
Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for misconfigured Users. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. Users unable to upgrade are advised to encrypt their backups independently of the iTop application. ### Patches Sanitize parameter ### References N°7631 - Password is stored in clear in the database.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| iTop | <3.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-51993?
CVE-2024-51993 has been classified as a high severity vulnerability due to the potential exposure of sensitive passwords.
How do I fix CVE-2024-51993?
To fix CVE-2024-51993, it is recommended to upgrade to version 3.2.0 of Combodo iTop.
What impact does CVE-2024-51993 have on users?
CVE-2024-51993 allows attackers to access backup files or databases to read misconfigured user passwords.
Is there a workaround for CVE-2024-51993 if I cannot upgrade?
If unable to upgrade due to restrictions, users should reconfigure their settings to ensure sensitive data is not accessible.
When was CVE-2024-51993 disclosed?
CVE-2024-51993 was disclosed recently, emphasizing the importance for users to take immediate action.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- agent/severity
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/combodo
- canonical/itop