What is CVE-2023-48709?

CVE-2023-48709 is a high-severity vulnerability in Combodo Itop, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 8.0/10. Published 2024-04-15.

How severe is CVE-2023-48709?

High severity. CVSS v3 base score is 8.0 out of 10.

Vulnerability in Combodo Itop

CVE-2023-48709

iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include malicious formulas that may be imported into Excel. As Excel 2016 does **not** prevent Remote Code Execution by default, uninformed users may become victims. This vulnerability is fixed in 2.7.9, 3.0.4, 3.1.1, and 3.2.0.

EPSS: 0.010 (57.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.

Affected products

Combodo Itop — versions < 2.7.9, >= 3.0.0, < 3.0.4, >= 3.1.0, < 3.1.1

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2023-48709?: CVE-2023-48709 is a high-severity vulnerability in Combodo Itop, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 8.0/10. Published 2024-04-15.
How severe is CVE-2023-48709?: High severity. CVSS v3 base score is 8.0 out of 10.