CVE-2023-48710 - CVE House
Back to Database
Status published Critical CVE-2023-48710

iTop limit pages/exec.php script to PHP files

Vulnerability Description

iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted access. Hopefully, there is no sensitive files stored in that folder natively, but there could be from a third-party module. The `pages/exec.php` script as been fixed to limit execution of PHP files only. Other file types won't be retrieved and exposed. The vulnerability is fixed in 2.7.10, 3.0.4, 3.1.1, and 3.2.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-48710

Credits & Attribution

No credits recorded in the NVD database.

References

More from Combodo

View All →
CVE-2025-64167
Combodo iTop vulnerable to reflected XSS in webservices/export.php
High 7.1
CVE-2025-49145
iTop admin can drop iTop database using webhooks
High 8.7
CVE-2025-48878
Combodo iTop vulnerable to IDOR with ModuleInstallation object
Medium 4.3
CVE-2025-48065
Combodo iTop vulnerable to reflected XSS via objection edition form error
High 8.8
CVE-2025-48055
Combodo iTop has stored XSS in user portal's browse brick
High 8.5

Affected Vendor

Affected Software

iTop
Vulnerable Versions:
< 2.7.10, >= 3.0.0, < 3.0.4, >= 3.1.0, < 3.1.1

Timeline

Official Publish: April 15th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-552

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1083 File and Directory Discovery
Discovery
T1005 Data from Local System
Collection
T1041 Exfiltration Over C2 Channel
Exfiltration
T1565 Data Manipulation
Impact