Impact

When creating or updating an object, extkey values aren't checked against current user silo. In other words, by forging an http request, the user can create objects pointing to out of silo objects: for example a UserRequest in an out of scop Organization.

Patches

Fixed in iTop 2.7.10, 3.0.4, 3.1.1, 3.2.0

References

• Combodo ref N°6458
• Huntr : attackers can create contacts , services or bugs in other groups in combodo/itop

Credits

@lujiefsi

For more information

If you have any questions or comments about this advisory:
Email us at itop-security@combodo.com