Impact

Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file.

Patches

Fixed in 3.0.4, 3.1.1

References

• Synacktiv publication : https://www.synacktiv.com/advisories/file-read-in-itop
• Combodo ref N°6552 and N°6581

Credits

Many thanks to Jérôme Mampianinazakason (Synacktiv) for this report !

For more information

If you have any questions or comments about this advisory:
Email us at itop-security@combodo.com