CVE-2020-15218

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, admin pages are cached, so that their content is visible after deconnection by using the browser back button. This is fixed in versions 2.7.2 and 3.0.0.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
Combodo	iTop	< 2.7.2

References

https://github.com/Combodo/iTop/security/advisories/GHSA-3m3g-86hp-5p2jThird Party Advisory
https://github.com/Combodo/iTop/security/advisories/GHSA-3m3g-86hp-5p2jThird Party Advisory

Timeline

Published: Jan 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-152194.3Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, when a download error is triggered in the u CVE-2020-15227.8An elevation of privilege vulnerability exists when the Windows Speech Runtime improperly handles memory. To exploit this vulnerability, an CVE-2020-152206.1Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, two cookies are created for the same sessio CVE-2020-152215.4Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, by modifying target browser local storage, CVE-2020-152228.1In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authenticati CVE-2020-152238.0In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores erro CVE-2020-152246.8In Open Enclave before version 0.12.0, an information disclosure vulnerability exists when an enclave application using the syscalls provide CVE-2020-152256.5django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatica CVE-2020-152264.3In GLPI before version 9.5.2, there is a SQL Injection in the API's search function. Not only is it possible to break the SQL syntax, but it CVE-2020-152279.8Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed p CVE-2020-152285.0In the `@actions/core` npm module before version 1.2.6,`addPath` and `exportVariable` functions communicate with the Actions Runner over std CVE-2020-152299.3Singularity (an open source container platform) from version 3.1.1 through 3.6.3 has a vulnerability. Due to insecure handling of path trave