CVE-2019-11215 - CVE House
Back to Database
Status published High CVE-2019-11215

In Combodo iTop 2.2.0 through 2.6.0, if the configuration file...

Vulnerability Description

In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader with a maliciously crafted payload. Many conditions can place the configuration file into a writable state: during installation; during upgrade; in certain cases, an error during modification of the file from the web interface leaves the file writable (can be triggered with XSS); a race condition can be triggered by the hub-connector module (community version only from 2.4.1 to 2.6.0); or editing the file in a CLI.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-11215

Credits & Attribution

No credits recorded in the NVD database.

References

More from combodo

View All →
CVE-2022-31403
ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS)...
Medium 6.1
CVE-2022-31402
ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS)...
Medium 6.1
CVE-2020-11697
In Combodo iTop, dashboard ids can be exploited with a...
Medium 6.1
CVE-2020-11696
In Combodo iTop a menu shortcut name can be exploited...
Medium 6.1
CVE-2019-19821
A post-authentication privilege escalation in the web application of Combodo...
High 8.1

Affected Vendor

Affected Software

itop
Vulnerable Versions:
2.2.0, 2.4.1

Timeline

Official Publish: February 14th, 2020
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.