CVE-2023-48709

iTop vulnerable to potential formula injection in Excel/CSV export file

State: Published
Severity: 8.0 High
Published: Apr 15, 2024
Updated: Aug 2, 2024
Reserved: Nov 17, 2023

Description

iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas that may be imported into Excel. As Excel 2016 does **not** prevent Remote Code Execution by default, uninformed users may become victims. This vulnerability is fixed in 2.7.9, 3.0.4, 3.1.1, and 3.2.0.

Scores

CVSS	Score	Vector	Source
3.1	8.0 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-1236 Improper Neutralization of Formula Elements in a CSV File
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Affected Products

Product	Versions
iTopCombodo	< 2.7.9Affected >= 3.0.0, < 3.0.4Affected >= 3.1.0, < 3.1.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.