Total vulnerabilities in the database
iTop is an IT service management platform. Files from the env-production folder can be retrieved even though they should have restricted access. Hopefully, there is no sensitive files stored in that folder natively, but there could be from a third-party module.
The pages/exec.php script as been fixed to limit execution of PHP files only. Other file types won't be retrieved and exposed. The vulnerability is fixed in 2.7.10, 3.0.4, 3.1.1, and 3.2.0.
| Software | From | Fixed in |
|---|---|---|
| combodo / itop | 3.0.0 | 3.0.4 |
| combodo / itop | 3.1.0 | 3.1.1 |
| combodo / itop | - | 2.7.10 |