CVE-2020-4079

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functionality is called directly it allows getting data without scope filtering. This allows a user to access data they which they should not have access to. This is fixed in versions 2.7.2 and 3.0.0.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jan 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-40806.1HCL Verse v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of message content. An un CVE-2020-40816.1In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting (XSS).CVE-2020-40825.4The HCL Connections 5.5 help system is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote at CVE-2020-40835.5HCL Connections 6.5 is vulnerable to possible information leakage. Connections could disclose sensitive information via trace logs to a loca CVE-2020-40845.4HCL Connections v5.5, v6.0, and v6.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript c CVE-2020-40856.5"HCL Connections is vulnerable to possible information leakage and could disclose sensitive information via stack trace to a local user."CVE-2020-40896.5HCL Notes is vulnerable to an information leakage vulnerability through its support for the 'mailto' protocol. This vulnerability could resu CVE-2020-40925.3"If port encryption is not enabled on the Domino Server, HCL Nomad on Android and iOS Platforms will communicate in clear text and does not CVE-2020-40956.0"BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can CVE-2020-40976.8In HCL Notes version 9 previous to release 9.0.1 FixPack 10 Interim Fix 8, version 10 previous to release 10.0.1 FixPack 6 and version 11 pr CVE-2020-40997.5The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures CVE-2020-41004.4"HCL Verse for Android was found to employ dynamic code loading. This mechanism allows a developer to specify which components of the applic