Lucene search
GitHub_MCVELIST:CVE-2020-15220HistoryJan 13, 2021 - 5:05 p.m.
CVE-2020-15220 Session fixation
2021-01-1317:05:17
CWE-613
GitHub_M
www.cve.org
4
combodo itop
it service management
session fixation
cve-2020-15220
user session
web based
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
33.8%
Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, two cookies are created for the same session, which leads to a possibility to steal user session. This is fixed in versions 2.7.2 and 3.0.0.
CNA Affected
[
{
"product": "iTop",
"vendor": "Combodo",
"versions": [
{
"status": "affected",
"version": "< 2.7.2"
}
]
}
]Related
osv
osv
CVE-2020-15220
2021-01-13 17:15:12
nvd
nvd
CVE-2020-15220
2021-01-13 17:15:12
prion
prion
Design/Logic Flaw
2021-01-13 17:15:00
cve
cve
CVE-2020-15220
2021-01-13 17:15:12
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
33.8%
Related for CVELIST:CVE-2020-15220