What is the CVSS score of CVE-2024-51993?

CVE-2024-51993 has a CVSS 3.1 base score of 3.4 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Itop CVE-2024-51993

LOW

Cleartext Storage of Sensitive Information (CWE-312)

2024-11-07 security-advisories@github.com

Information Disclosure Itop

3.4

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

3.4 LOW

AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Primary rating from Vendor (github) · only source for this CVE.

CVSS VectorVendor: github

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Nov 07, 2024 - 18:15 cve.org

LOW 3.4

DescriptionCVE.org

Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for misconfigured Users. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. Users unable to upgrade are advised to encrypt their backups independently of the iTop application.

Patches

Sanitize parameter

References

N°7631 - Password is stored in clear in the database.

AnalysisAI

Combodo iTop is a web based IT Service Management tool. Rated low severity (CVSS 3.4), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-312. Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for misconfigured Users. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. Users unable to upgrade are advised to encrypt their backups independently of the iTop application.

Patches Sanitize parameter

References N°7631 - Password is stored in clear in the database. Affected products include: Combodo Itop. Version information: version 3.2.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.