CVE-2023-43790

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname value. This vulnerability is fixed in 3.1.1 and 3.2.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79CWE-80

Affected software

VendorProductVersions
CombodoiTop>= 3.1.0, < 3..1.1

References

Timeline

Published
Apr 15, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-437918.8Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chainedCVE-2023-437929.8baserCMS is a website development framework. In versions 4.6.0 through 4.7.6, there is a Code Injection vulnerability in the mail form of baCVE-2023-437937.5Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentCVE-2023-437944.9Nocodb is an open source Airtable alternative. Affected versions of nocodb contain a SQL injection vulnerability, that allows an authenticatCVE-2023-437959.8GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The OGC Web Processing ServCVE-2023-437965.3Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queriedCVE-2023-437975.4BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripCVE-2023-437985.4BigBlueButton is an open-source virtual classroom. BigBlueButton prior to versions 2.6.12 and 2.7.0-rc.1 is vulnerable to Server-Side RequesCVE-2023-437997.8Altair is a GraphQL Client. Prior to version 5.2.5, the Altair GraphQL Client Desktop Application does not sanitize external URLs before pasCVE-2023-43806.3A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaCVE-2023-438007.8Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint `/v2/pkgs/tools/installed`. A uCVE-2023-438017.1Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and