CVE-2020-15218 : Security Advisory and Response

Combodo iTop is a web-based IT Service Management tool with a vulnerability that allows admin pages to be cached and visible after disconnection. This CVE affects iTop versions prior to 2.7.2 and 3.0.0.

Understanding CVE-2020-15218

This CVE relates to the caching of admin pages in Combodo iTop, potentially exposing sensitive information.

What is CVE-2020-15218?

In Combodo iTop versions before 2.7.2 and 3.0.0, admin pages are cached, making their content accessible even after the user logs out, by using the browser back button. This security flaw can lead to unauthorized access to confidential data.

The Impact of CVE-2020-15218

The vulnerability has a CVSS base score of 6.8, indicating a medium severity issue. It poses a high risk to confidentiality as it allows unauthorized users to view sensitive information.

Technical Details of CVE-2020-15218

This section provides more in-depth technical insights into the CVE.

Vulnerability Description

The vulnerability in Combodo iTop allows admin pages to be cached, enabling unauthorized access to sensitive data post disconnection.

Affected Systems and Versions

Product: iTop
Vendor: Combodo
Affected Versions: < 2.7.2

Exploitation Mechanism

Attack Complexity: Low
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Scope: Changed
Confidentiality Impact: High
Integrity Impact: None
Availability Impact: None

Mitigation and Prevention

Protecting systems from CVE-2020-15218 requires immediate action and long-term security measures.

Immediate Steps to Take

Upgrade iTop to version 2.7.2 or higher to mitigate the vulnerability.
Clear browser cache regularly to prevent unauthorized access to cached admin pages.

Long-Term Security Practices

Implement strong session management practices to ensure sessions expire promptly.
Regularly monitor and audit access to sensitive information to detect unauthorized activities.

Patching and Updates

Apply patches and updates provided by Combodo to address the vulnerability and enhance system security.