CVE-2023-48709

CVSS V2 None CVSS V3 None

Description

iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas that may be imported into Excel. As Excel 2016 does **not** prevent Remote Code Execution by default, uninformed users may become victims. This vulnerability is fixed in 2.7.9, 3.0.4, 3.1.1, and 3.2.0.

Overview

CVE ID
CVE-2023-48709

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-04-15T17:43:05.871Z

Last Modified Date
2024-06-17T20:05:33.014Z

Weakness Enumerations

CWE	URL
CWE-1236	http://cwe.mitre.org/data/definitions/1236.html
CWE-74	http://cwe.mitre.org/data/definitions/74.html

References

Reference URL	Reference Tags
https://github.com/Combodo/iTop/security/advisories/GHSA-9q3x-9987-53x9	x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/083a0b79bfa2c106735b5c10eddb35a05ec7f04a	x_refsource_MISC
https://github.com/Combodo/iTop/commit/b10bcb976dfe8e55aa0f659bfbcdd18334a1b17c	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-48709
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48709

History

Created	Old Value	New Value	Data Type	Notes
2024-06-25 00:19:07				Added to TrackCVE