SB2020031628 - Improper privilege management in Combodo iTop
Published: March 16, 2020 Updated: August 10, 2020
Security Bulletin ID
SB2020031628
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper Privilege Management (CVE-ID: CVE-2019-19821)
The vulnerability allows a remote user to escalate privileges within the application.
A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify information with administrative privileges by not following the HTTP Location header in server responses.
Remediation
Install update from vendor's website.