#VU25467 Resource management error in iTop - CVE-2019-13967
Published: February 19, 2020
Vulnerability identifier: #VU25467
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: CVE-2019-13967
CWE-ID: CWE-399
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
iTop
iTop
Software vendor:
Combodo
Combodo
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application is unable to handle multiple request to launch a compile operation. A remote attacker can send multiple request pages/exec.php?exec_env=production&exec_module=itop-hub-connector&exec_page=ajax.php&operation=compile URI and perform a denial of service attack.
Remediation
Install update from vendor's website.