CVE-2023-48710

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-48710
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-48710.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-48710
Aliases
  • GHSA-g652-q7cc-7hfc
Published
2024-04-15T17:47:51.113Z
Modified
2025-11-29T15:00:33.900941Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
iTop limit pages/exec.php script to PHP files
Details

iTop is an IT service management platform. Files from the env-production folder can be retrieved even though they should have restricted access. Hopefully, there is no sensitive files stored in that folder natively, but there could be from a third-party module. The pages/exec.php script as been fixed to limit execution of PHP files only. Other file types won't be retrieved and exposed. The vulnerability is fixed in 2.7.10, 3.0.4, 3.1.1, and 3.2.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-552"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48710.json"
}
References

Affected packages

Git / github.com/combodo/itop

Affected ranges

Type
GIT
Repo
https://github.com/combodo/itop
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2fd9523c16d9183c2be282b98a58ce15bf74a365
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.7.10"
        }
    ]
}
Type
GIT
Repo
https://github.com/combodo/itop
Events
Introduced
682c821d0ef14224b2182ea5840ae1739600bc22
Fixed
b8892e965161992618dbfdbe6aa89eda79d6c92d
Database specific 
{
    "versions": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.4"
        }
    ]
}
Type
GIT
Repo
https://github.com/combodo/itop
Events
Introduced
9b409b117f4b5308678d6ab4f3e3ea6dc1fd58cd
Fixed
be699b4358b253d34835f763316877a66e1ba072
Database specific 
{
    "versions": [
        {
            "introduced": "3.1.0"
        },
        {
            "fixed": "3.1.1"
        }
    ]
}

Affected versions

1.*

1.0.8

2.*

2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.0-a
2.6.0-products
2.6.1
2.6.2
2.6.2-1
2.6.2-2
2.6.3
2.6.4
2.7.0
2.7.0-1
2.7.0-2
2.7.0-alpha1
2.7.0-beta
2.7.0-beta2
2.7.0-rc
2.7.0-rc2
2.7.1
2.7.10
2.7.2
2.7.2-1
2.7.3
2.7.3-1
2.7.3-2
2.7.4
2.7.5
2.7.5-1
2.7.5-2
2.7.6
2.7.7
2.7.8
2.7.9

3.*

3.0.0
3.0.1
3.0.1-designer-feature-lot1
3.0.1-designer-feature-lot2
3.0.2
3.0.2-1
3.0.2-rc1
3.0.3
3.0.3-1
3.0.3-designer-php8.0-compatibility
3.1.0
3.1.0-1
3.1.0-2
3.1.0-3
3.1.0-designer-2

Other

N1963
N2011
N2016
N941
N941-2
itop-carbon