Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2020-4062: Other (NVD-CWE-Other)
value: In Conjur OSS Helm Chart before 2.0.0, a recently identified critical vulnerability resulted in the installation of the Conjur Postgres database with an open port. This allows an attacker to gain full read & write access to the Conjur Postgres database, including escalating the attacker's privileges to assume full control. A malicious actor who knows the IP address and port number of the Postgres database and has access into the Kubernetes cluster where Conjur runs can gain full read & write access to the Postgres database. This enables the attacker to write a policy that allows full access to retrieve any secret. This Helm chart is a method to install Conjur OSS into a Kubernetes environment. Hence, the systems impacted are only Conjur OSS systems that were deployed using this chart. Other deployments including Docker and the CyberArk Dynamic Access Provider (DAP) are not affected. To remediate this vulnerability, clone the latest Helm Chart and follow the upgrade instructions. If you are not able to fully remediate this vulnerability immediately, you can mitigate some of the risk by making sure Conjur OSS is deployed on an isolated Kubernetes cluster or namespace. The term "isolated" refers to: - No other workloads besides Conjur OSS and its backend database are running in that Kubernetes cluster/namespace. - Kubernetes and helm access to the cluster/namespace is limited to security administrators via Role-Based Access Control (RBAC).
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9
Published: 2020-06-22T16:15Z
Repository: https://github.com/cyberark/conjur-oss-helm-chart
Language: Unknown
Commit date: 2020-06-18 12:59:55 -0500
Commit message: Merge pull request from GHSA-mg2m-623j-wpxw

Adds postgres password configuration
CVE-2021-23165: Out-of-bounds Write (CWE-787)
value: A flaw was found in htmldoc before v1.9.12. Heap buffer overflow in pspdf_prepare_outpages(), in ps-pdf.cxx may lead to execute arbitrary code and denial of service.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2022-03-16T15:15Z
Repository: https://github.com/michaelrsweet/htmldoc
Language: Markdown
Files changed: CHANGES.md, htmldoc/ps-pdf.cxx
Commit date: 2021-04-01 09:47:56 -0400
Commit message: Fix a number-up crash bug (Issue #413)

Diff: diff --git a/CHANGES.md b/CHANGES.md
index 224cbc30..f8443d4d 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,9 +1,10 @@
 # Changes in HTMLDOC v1.9.12
 
 - Fixed a crash bug with "data:" URIs and EPUB output (Issue #410)
-- Fixed JPEG error handling (Issue #415)
+- Fixed a number-up crash bug (Issue #413)
+- Fixed JPEG error handling (Issue #414, Issue #415)
 - Fixed crash bugs with bogus table attributes (Issue #416, Issue #417)
 - Fixed a crash bug with malformed URIs (Issue #418)
 - Fixed a crash bug with malformed GIF files (Issue #423)
 - Fixed some issues reported by Coverity.
 
diff --git a/htmldoc/ps-pdf.cxx b/htmldoc/ps-pdf.cxx
index e963959b..ac95ba5a 100644
--- a/htmldoc/ps-pdf.cxx
+++ b/htmldoc/ps-pdf.cxx
@@ -1316,11 +1316,11 @@ pspdf_prepare_outpages()
       continue;
 
     chapter_outstarts[c] = num_outpages;
 
     for (i = chapter_starts[c], j = 0, nup = -1, page = pages + i;
-         i <= chapter_ends[c];
+         i <= chapter_ends[c] && num_outpages < num_pages;
 	 i ++, page ++)
     {
       if (nup != page->nup)
       {
         if (j)

Vulnerable code: - Fixed JPEG error handling (Issue #415)
         i <= chapter_ends[c];
Fixed code: - Fixed a number-up crash bug (Issue #413)
- Fixed JPEG error handling (Issue #414, Issue #415)
         i <= chapter_ends[c] && num_outpages < num_pages;
CVE-2021-23180: NULL Pointer Dereference (CWE-476)
value: A flaw was found in htmldoc in v1.9.12 and before. Null pointer dereference in file_extension(),in file.c may lead to execute arbitrary code and denial of service.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.8
Published: 2022-03-02T23:15Z
Repository: https://github.com/michaelrsweet/htmldoc
Language: C
Files changed: CHANGES.md, htmldoc/file.c
Commit date: 2021-01-26 08:02:32 -0500
Commit message: Fix a crash bug with malformed URIs (Issue #418)

Diff: diff --git a/CHANGES.md b/CHANGES.md
index bc3bfb30..65cb9020 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,8 +1,9 @@
 # Changes in HTMLDOC v1.9.12
 
 - Fixed a crash bug with "data:" URIs and EPUB output (Issue #410)
+- Fixed a crash bug with malformed URIs (Issue #418)
 - Fixed some issues reported by Coverity.
 
 
 # Changes in HTMLDOC v1.9.11
 
diff --git a/htmldoc/file.c b/htmldoc/file.c
index fec96bd9..f2f3822c 100644
--- a/htmldoc/file.c
+++ b/htmldoc/file.c
@@ -302,10 +302,11 @@ file_directory(const char *s)	/* I - Filename or URL */
 
 const char *			/* O - File extension */
 file_extension(const char *s)	/* I - Filename or URL */
 {
   const char	*extension;	/* Pointer to directory separator */
+  char		*bufptr;	/* Pointer into buffer */
   static char	buf[1024];	/* Buffer for files with targets */
 
 
   if (s == NULL)
     return (NULL);
@@ -332,11 +333,12 @@ file_extension(const char *s)	/* I - Filename or URL */
   if (strchr(extension, '#') == NULL)
     return (extension);
 
   strlcpy(buf, extension, sizeof(buf));
 
-  *(char *)strchr(buf, '#') = '\0';
+  if ((bufptr = strchr(buf, '#')) != NULL)
+    *bufptr = '\0';
 
   return (buf);
 }
 
 

Vulnerable code:   *(char *)strchr(buf, '#') = '\0';
Fixed code: - Fixed a crash bug with malformed URIs (Issue #418)
  char		*bufptr;	/* Pointer into buffer */
  if ((bufptr = strchr(buf, '#')) != NULL)
    *bufptr = '\0';
CVE-2021-34119: Out-of-bounds Write (CWE-787)
value: A flaw was discovered in htmodoc 1.9.12 in function parse_paragraph in ps-pdf.cxx ,this flaw possibly allows possible code execution and a denial of service via a crafted file.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2023-07-18T14:15Z
Repository: https://github.com/michaelrsweet/htmldoc
Language: Markdown
Files changed: CHANGES.md, htmldoc/ps-pdf.cxx
Commit date: 2021-05-17 09:10:37 -0400
Commit message: Fix another crash bug with bogus data (Issue #431)

Diff: diff --git a/CHANGES.md b/CHANGES.md
index c260fa15..220c87b5 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -6,11 +6,11 @@
 - Fixed JPEG error handling (Issue #415)
 - Fixed crash bugs with bogus table attributes (Issue #416, Issue #417)
 - Fixed a crash bug with malformed URIs (Issue #418)
 - Fixed a crash bug with malformed GIF files (Issue #423)
 - Fixed a crash bug with empty titles (Issue #425)
-- Fixed a crash bug with bogus text (Issue #426)
+- Fixed a crash bug with bogus text (Issue #426, Issue #431)
 - Fixed some issues reported by Coverity.
 - Removed the bundled libjpeg, libpng, and zlib.
 
 
 # Changes in HTMLDOC v1.9.11
diff --git a/htmldoc/ps-pdf.cxx b/htmldoc/ps-pdf.cxx
index cd6bd726..69a8666c 100644
--- a/htmldoc/ps-pdf.cxx
+++ b/htmldoc/ps-pdf.cxx
@@ -5008,11 +5008,11 @@ parse_paragraph(tree_t *t,	/* I - Tree to parse */
         if ((temp_width >= format_width && prev->markup == MARKUP_IMG) ||
 	    prev->markup == MARKUP_BR)
 	{
 	  break;
 	}
-	else if (prev->markup == MARKUP_NONE)
+	else if (prev->markup == MARKUP_NONE && *(prev->data))
 	{
 	  int	ch = prev->data[strlen((char *)prev->data) - 1];
 
 	  if (_htmlUTF8)
 	    ch = _htmlUnicode[ch];

Vulnerable code: - Fixed a crash bug with bogus text (Issue #426)
	else if (prev->markup == MARKUP_NONE)
Fixed code: - Fixed a crash bug with bogus text (Issue #426, Issue #431)
	else if (prev->markup == MARKUP_NONE && *(prev->data))
CVE-2021-40985: Out-of-bounds Read (CWE-125)
value: A stack-based buffer under-read in htmldoc before 1.9.12, allows attackers to cause a denial of service via a crafted BMP image to image_load_bmp.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2021-11-03T17:15Z
Repository: https://github.com/michaelrsweet/htmldoc
Language: Markdown
Files changed: CHANGES.md, htmldoc/image.cxx
Commit date: 2021-09-11 18:12:33 -0400
Commit message: Fix BMP crash bug (Issue #444)

Diff: diff --git a/CHANGES.md b/CHANGES.md
index 4d315dd3..7a5caf2a 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -3,10 +3,11 @@
 - Now install a 32x32 icon for Linux (Issue #432)
 - Fixed an issue with large values for roman numerals and letters in headings
   (Issue #433)
 - Fixed a crash bug when a HTML comment contains an invalid nul character
   (Issue #439)
+- Fixed a crash bug with bogus BMP images (Issue #444)
 
 
 # Changes in HTMLDOC v1.9.12
 
 - Fixed a crash bug with "data:" URIs and EPUB output (Issue #410)
diff --git a/htmldoc/image.cxx b/htmldoc/image.cxx
index 337c0cc5..d44d1ba3 100644
--- a/htmldoc/image.cxx
+++ b/htmldoc/image.cxx
@@ -913,10 +913,13 @@ image_load_bmp(image_t *img,	/* I - Image to load into */
   read_long(fp);
   read_long(fp);
   colors_used      = (int)read_dword(fp);
   read_dword(fp);
 
+  if (img->width <= 0 || img->width > 8192 || img->height <= 0 || img->height > 8192)
+    return (-1);
+
   if (info_size > 40)
     for (info_size -= 40; info_size > 0; info_size --)
       getc(fp);
 
   // Get colormap...
@@ -924,11 +927,11 @@ image_load_bmp(image_t *img,	/* I - Image to load into */
     colors_used = 1 << depth;
 
   fread(colormap, (size_t)colors_used, 4, fp);
 
   // Setup image and buffers...
-  img->depth  = gray ? 1 : 3;
+  img->depth = gray ? 1 : 3;
 
   // If this image is indexed and we are writing an encrypted PDF file, bump the use count so
   // we create an image object (Acrobat 6 bug workaround)
   if (depth <= 8 && Encryption)
     img->use ++;
@@ -1074,11 +1077,11 @@ image_load_bmp(image_t *img,	/* I - Image to load into */
 	    count --;
 
             if (bit == 0xf0)
 	    {
               if (color < 0)
-		temp = getc(fp);
+		temp = getc(fp) & 255;
 	      else
 		temp = color;
 
              /*
 	      * Copy the color value...

Vulnerable code:   img->depth  = gray ? 1 : 3;
		temp = getc(fp);
Fixed code: - Fixed a crash bug with bogus BMP images (Issue #444)
  if (img->width <= 0 || img->width > 8192 || img->height <= 0 || img->height > 8192)
    return (-1);

  img->depth = gray ? 1 : 3;
		temp = getc(fp) & 255;
CVE-2021-43579: Out-of-bounds Write (CWE-787)
value: A stack-based buffer overflow in image_load_bmp() in HTMLDOC <= 1.9.13 results in remote code execution if the victim converts an HTML document linking to a crafted BMP file.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2022-01-10T14:10Z
Repository: https://github.com/michaelrsweet/htmldoc
Language: Markdown
Files changed: CHANGES.md, htmldoc/image.cxx
Commit date: 2021-11-05 09:35:10 -0400
Commit message: Fix potential BMP stack overflow (Issue #453)

Diff: diff --git a/CHANGES.md b/CHANGES.md
index 7a5caf2a..e77833e8 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -4,10 +4,11 @@
 - Fixed an issue with large values for roman numerals and letters in headings
   (Issue #433)
 - Fixed a crash bug when a HTML comment contains an invalid nul character
   (Issue #439)
 - Fixed a crash bug with bogus BMP images (Issue #444)
+- Fixed a stack overflow bug with bogus BMP images (Issue #453)
 
 
 # Changes in HTMLDOC v1.9.12
 
 - Fixed a crash bug with "data:" URIs and EPUB output (Issue #410)
diff --git a/htmldoc/image.cxx b/htmldoc/image.cxx
index d44d1ba3..a62a06f6 100644
--- a/htmldoc/image.cxx
+++ b/htmldoc/image.cxx
@@ -917,16 +917,20 @@ image_load_bmp(image_t *img,	/* I - Image to load into */
 
   if (img->width <= 0 || img->width > 8192 || img->height <= 0 || img->height > 8192)
     return (-1);
 
   if (info_size > 40)
+  {
     for (info_size -= 40; info_size > 0; info_size --)
       getc(fp);
+  }
 
   // Get colormap...
   if (colors_used == 0 && depth <= 8)
     colors_used = 1 << depth;
+  else if (colors_used > 256)
+    return (-1);
 
   fread(colormap, (size_t)colors_used, 4, fp);
 
   // Setup image and buffers...
   img->depth = gray ? 1 : 3;

Fixed code: - Fixed a stack overflow bug with bogus BMP images (Issue #453)
  {
  }
  else if (colors_used > 256)
    return (-1);
CVE-2022-0534: Out-of-bounds Read (CWE-125)
value: A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes place in gif_get_code() and occurs when opening a malicious GIF file, which can result in a crash (segmentation fault).
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-02-09T23:15Z
Repository: https://github.com/michaelrsweet/htmldoc
Language: Other
Files changed: htmldoc/image.cxx
Commit date: 2022-01-07 18:21:53 -0500
Commit message: Block GIF images with a code size > 12 (Issue #463)

Diff: diff --git a/htmldoc/image.cxx b/htmldoc/image.cxx
index ebc9371ab..a89cb49b0 100644
--- a/htmldoc/image.cxx
+++ b/htmldoc/image.cxx
@@ -303,10 +303,16 @@ gif_read_image(FILE       *fp,		/* I - Input file */
   xpos      = 0;
   ypos      = 0;
   pass      = 0;
   code_size = (uchar)getc(fp);
 
+  if (code_size > 12)
+  {
+    progress_error(HD_ERROR_READ_ERROR, "Bad GIF file \"%s\" - invalid code size %d.", img->filename, code_size);
+    return (-1);
+  }
+
   if (gif_read_lzw(fp, 1, code_size) < 0)
     return (-1);
 
   temp = img->pixels;
 
@@ -430,11 +436,11 @@ gif_read_lzw(FILE *fp,			/* I - File to read from */
   }
 
   if (sp > stack)
     return (*--sp);
 
-  while ((code = gif_get_code (fp, code_size, 0)) >= 0)
+  while ((code = gif_get_code(fp, code_size, 0)) >= 0)
   {
     if (code == clear_code)
     {
       for (i = 0; i < clear_code; i ++)
       {

Vulnerable code:   while ((code = gif_get_code (fp, code_size, 0)) >= 0)
Fixed code:   if (code_size > 12)
  {
    progress_error(HD_ERROR_READ_ERROR, "Bad GIF file \"%s\" - invalid code size %d.", img->filename, code_size);
    return (-1);
  }

  while ((code = gif_get_code(fp, code_size, 0)) >= 0)
CVE-2022-28085: Out-of-bounds Write (CWE-787)
value: A flaw was found in htmldoc commit 31f7804. A heap buffer overflow in the function pdf_write_names in ps-pdf.cxx may lead to arbitrary code execution and Denial of Service (DoS).
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2022-04-27T03:15Z
Repository: https://github.com/michaelrsweet/htmldoc
Language: Other
Files changed: htmldoc/ps-pdf.cxx
Commit date: 2022-03-24 16:30:07 -0400
Commit message: Call check_pages when writing links (Issue #480)

Diff: diff --git a/htmldoc/ps-pdf.cxx b/htmldoc/ps-pdf.cxx
index 4b79189fe..e7bc22d0f 100644
--- a/htmldoc/ps-pdf.cxx
+++ b/htmldoc/ps-pdf.cxx
@@ -3583,10 +3583,12 @@ pdf_write_names(FILE *out)		/* I - Output file */
   for (i = num_links, link = links; i > 0; i --, link ++)
   {
     pdf_start_object(out);
     float x, y;
 
+    check_pages(link->page);
+
     x = 0.0f;
     y = link->top + pages[link->page].bottom;
     pspdf_transform_coords(pages + link->page, x, y);
     fprintf(out, "/D[%d 0 R/XYZ %.0f %.0f 0]",
             pages_object + 2 * pages[link->page].outpage + 1, x, y);

Fixed code:     check_pages(link->page);
CVE-2022-1681: Improper Authentication (CWE-287)
value: Authentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. User can get root user permissions
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 7.2
Published: 2022-05-12T08:15Z
Repository: https://github.com/requarks/wiki
Language: JavaScript
Files changed: server/graph/resolvers/group.js
Commit date: 2022-05-09 21:36:13 -0400
Commit message: fix: prevent manage system assignment from manage groups permission

Diff: diff --git a/server/graph/resolvers/group.js b/server/graph/resolvers/group.js
index 3fc7db23..1e295979 100644
--- a/server/graph/resolvers/group.js
+++ b/server/graph/resolvers/group.js
@@ -171,10 +171,18 @@ module.exports = {
         })
       ) {
         throw new gql.GraphQLError('You are not authorized to manage this group or assign these permissions.')
       }
 
+      // Check assigned permissions for manage:groups
+      if (
+        WIKI.auth.checkExclusiveAccess(req.user, ['manage:groups'], ['manage:system']) &&
+        args.permissions.some(p => _.last(p.split(':')) === 'system')
+      ) {
+        throw new gql.GraphQLError('You are not authorized to manage this group or assign the manage:system permissions.')
+      }
+
       // Update group
       await WIKI.models.groups.query().patch({
         name: args.name,
         redirectOnLogin: args.redirectOnLogin,
         permissions: JSON.stringify(args.permissions),

Fixed code:       // Check assigned permissions for manage:groups
      if (
        WIKI.auth.checkExclusiveAccess(req.user, ['manage:groups'], ['manage:system']) &&
        args.permissions.some(p => _.last(p.split(':')) === 'system')
      ) {
        throw new gql.GraphQLError('You are not authorized to manage this group or assign the manage:system permissions.')
      }
CVE-2021-32664: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2021-10-19T18:15Z
Repository: https://github.com/Combodo/iTop
Language: PHP
Files changed: pages/run_query.php
Commit date: 2021-05-27 16:13:27 +0200
Commit message: N°4002 - code hardening

Diff: diff --git a/pages/run_query.php b/pages/run_query.php
index c6bc61648..b3bfa2161 100644
--- a/pages/run_query.php
+++ b/pages/run_query.php
@@ -110,11 +110,10 @@ ShowExamples($oP, $sExpression);
 try
 {
 	if ($sEncoding == 'crypted')
 	{
 		// Translate $sExpression into a oql expression
-		$sClearText = base64_decode($sExpression);
 		$oFilter = DBObjectSearch::unserialize($sExpression);
 		$sExpression = $oFilter->ToOQL();
 	}
 	else
 	{

Vulnerable code: 		$sClearText = base64_decode($sExpression);
CVE-2021-32664: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2021-10-19T18:15Z
Repository: https://github.com/Combodo/iTop
Language: Unknown
Commit date: 2021-05-27 16:36:00 +0200
Commit message: N°4002 - code hardening (merge from support/2.6)

Diff: diff --cc pages/run_query.php
index a8154c242,b3bfa2161..acccf06e0
--- a/pages/run_query.php
+++ b/pages/run_query.php
@@@ -103,15 -110,17 +103,13 @@@ ShowExamples($oP, $sExpression)
  try
  {
  	if ($sEncoding == 'crypted')
  	{
  		// Translate $sExpression into a oql expression
- 		$sClearText = base64_decode($sExpression);
- 		echo "<strong>FYI: '$sClearText'</strong><br/>\n";
  		$oFilter = DBObjectSearch::unserialize($sExpression);
  		$sExpression = $oFilter->ToOQL();
  	}
 -	else
 -	{
 -		// leave $sExpression as is
 -	}
  
  	$oFilter = null;
  	$aArgs = array();
  	$sSyntaxError = null;
CVE-2021-32664: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2021-10-19T18:15Z
Repository: https://github.com/Combodo/iTop
Language: PHP
Files changed: pages/run_query.php
Commit date: 2021-05-27 15:57:04 +0200
Commit message: N°4002 - code hardening

Diff: diff --git a/pages/run_query.php b/pages/run_query.php
index 2d9288c34..c6bc61648 100644
--- a/pages/run_query.php
+++ b/pages/run_query.php
@@ -111,11 +111,10 @@ try
 {
 	if ($sEncoding == 'crypted')
 	{
 		// Translate $sExpression into a oql expression
 		$sClearText = base64_decode($sExpression);
-		echo "<strong>FYI: '$sClearText'</strong><br/>\n";
 		$oFilter = DBObjectSearch::unserialize($sExpression);
 		$sExpression = $oFilter->ToOQL();
 	}
 	else
 	{

Vulnerable code: 		echo "<strong>FYI: '$sClearText'</strong><br/>\n";
CVE-2021-41162: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to beta6 the `ajax.render.php?operation=wizard_helper` page did not properly escape the user supplied parameters, allowing for a cross site scripting attack vector. Users are advised to upgrade. There are no known workarounds for this issue.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-04-21T17:15Z
Repository: https://github.com/Combodo/iTop
Language: PHP
Files changed: application/wizardhelper.class.inc.php
Commit date: 2021-10-14 15:46:46 +0200
Commit message: N°4362 - XSS in ajax.render.php?operation=wizard_helper on develop

Diff: diff --git a/application/wizardhelper.class.inc.php b/application/wizardhelper.class.inc.php
index 69557ce3ef..998386eaf0 100644
--- a/application/wizardhelper.class.inc.php
+++ b/application/wizardhelper.class.inc.php
@@ -348,12 +348,11 @@ class WizardHelper
 	 * @return string JS code to be executed for fields update
 	 * @since 3.0.0 N°3198
 	 */
 	public function GetJsForUpdateFields()
 	{
-		$sWizardHelperJsVar = (!is_null($this->m_aData['m_sWizHelperJsVarName'])) ? utils::Sanitize($this->m_aData['m_sWizHelperJsVarName'], utils::ENUM_SANITIZATION_FILTER_PARAMETER) : 'oWizardHelper'.$this->GetFormPrefix();
-		//str_replace(['(', ')', ';'], '', $this->m_aData['m_sWizHelperJsVarName']) : 'oWizardHelper'.$this->GetFormPrefix();
+		$sWizardHelperJsVar = (!is_null($this->m_aData['m_sWizHelperJsVarName'])) ? utils::Sanitize($this->m_aData['m_sWizHelperJsVarName'], '', utils::ENUM_SANITIZATION_FILTER_PARAMETER) : 'oWizardHelper'.$this->GetFormPrefix();
 		$sWizardHelperJson = $this->ToJSON();
 
 		return <<<JS
 {$sWizardHelperJsVar}.m_oData = {$sWizardHelperJson};
 {$sWizardHelperJsVar}.UpdateFields();

Vulnerable code: 		$sWizardHelperJsVar = (!is_null($this->m_aData['m_sWizHelperJsVarName'])) ? utils::Sanitize($this->m_aData['m_sWizHelperJsVarName'], utils::ENUM_SANITIZATION_FILTER_PARAMETER) : 'oWizardHelper'.$this->GetFormPrefix();
		//str_replace(['(', ')', ';'], '', $this->m_aData['m_sWizHelperJsVarName']) : 'oWizardHelper'.$this->GetFormPrefix();
Fixed code: 		$sWizardHelperJsVar = (!is_null($this->m_aData['m_sWizHelperJsVarName'])) ? utils::Sanitize($this->m_aData['m_sWizHelperJsVarName'], '', utils::ENUM_SANITIZATION_FILTER_PARAMETER) : 'oWizardHelper'.$this->GetFormPrefix();
CVE-2022-39216: Use of Insufficiently Random Values (CWE-330)
value: Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, the reset password token is generated without any randomness parameter. This may lead to account takeover. The issue is fixed in versions 2.7.8 and 3.0.2-1.
CWE description: The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
CVSS v3 base score: 9.8
Published: 2023-03-14T16:15Z
Repository: https://github.com/Combodo/iTop
Language: PHP
Files changed: application/loginwebpage.class.inc.php
Commit date: 2022-08-12 11:33:55 +0200
Commit message: N°5393 Security hardening

Diff: diff --git a/application/loginwebpage.class.inc.php b/application/loginwebpage.class.inc.php
index 47cfe65631..3745589dc3 100644
--- a/application/loginwebpage.class.inc.php
+++ b/application/loginwebpage.class.inc.php
@@ -206,11 +206,11 @@ class LoginWebPage extends NiceWebPage
 				{
 					throw new Exception(Dict::S('UI:ResetPwd-Error-NoEmail'));
 				}
 
 				// This token allows the user to change the password without knowing the previous one
-				$sToken = substr(md5(APPROOT.uniqid()), 0, 16);
+				$sToken = bin2hex(random_bytes(32));
 				$oUser->Set('reset_pwd_token', $sToken);
 				CMDBObject::SetTrackInfo('Reset password');
 				$oUser->AllowWrite(true);
 				$oUser->DBUpdate();
 

Vulnerable code: 				$sToken = substr(md5(APPROOT.uniqid()), 0, 16);
Fixed code: 				$sToken = bin2hex(random_bytes(32));
CVE-2022-39216: Use of Insufficiently Random Values (CWE-330)
value: Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, the reset password token is generated without any randomness parameter. This may lead to account takeover. The issue is fixed in versions 2.7.8 and 3.0.2-1.
CWE description: The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
CVSS v3 base score: 9.8
Published: 2023-03-14T16:15Z
Repository: https://github.com/Combodo/iTop
Language: PHP
Files changed: application/loginwebpage.class.inc.php
Commit date: 2022-08-12 09:54:35 +0200
Commit message: N°5393 Security hardening

Diff: diff --git a/application/loginwebpage.class.inc.php b/application/loginwebpage.class.inc.php
index 9f07357841..10abc3cf36 100644
--- a/application/loginwebpage.class.inc.php
+++ b/application/loginwebpage.class.inc.php
@@ -239,11 +239,11 @@ class LoginWebPage extends NiceWebPage
 				{
 					throw new Exception(Dict::S('UI:ResetPwd-Error-NoEmail'));
 				}
 
 				// This token allows the user to change the password without knowing the previous one
-				$sToken = substr(md5(APPROOT.uniqid()), 0, 16);
+				$sToken = bin2hex(random_bytes(32));
 				$oUser->Set('reset_pwd_token', $sToken);
 				CMDBObject::SetTrackInfo('Reset password');
 				$oUser->AllowWrite(true);
 				$oUser->DBUpdate();
 

Vulnerable code: 				$sToken = substr(md5(APPROOT.uniqid()), 0, 16);
Fixed code: 				$sToken = bin2hex(random_bytes(32));
CVE-2023-34446: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, when displaying `pages/preferences.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0.

CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-10-25T18:17Z
Repository: https://github.com/Combodo/iTop
Language: PHP
Files changed: pages/preferences.php
Commit date: 2023-06-01 16:36:56 +0200
Commit message: N°6349 - Hardening code

Diff: diff --git a/pages/preferences.php b/pages/preferences.php
index adf2929c38..8359ad4e0c 100644
--- a/pages/preferences.php
+++ b/pages/preferences.php
@@ -777,11 +777,11 @@ try {
 				$aShortcutClasses = utils::GetClassesForInterface('iKeyboardShortcut', '', array('[\\\\/]lib[\\\\/]', '[\\\\/]node_modules[\\\\/]', '[\\\\/]test[\\\\/]', '[\\\\/]tests[\\\\/]'));
 				$aShortcutPrefs = [];
 				foreach ($aShortcutClasses as $cShortcutPlugin) {
 					foreach ($cShortcutPlugin::GetShortcutKeys() as $aShortcutKey) {
 						$sKey = utils::ReadParam($aShortcutKey['id'], $aShortcutKey['key'], true, 'raw_data');
-						$aShortcutPrefs[$aShortcutKey['id']] = strtolower($sKey);
+						$aShortcutPrefs[$aShortcutKey['id']] = strtolower(utils::HtmlEntities($sKey));
 					}
 				}
 				appUserPreferences::SetPref('keyboard_shortcuts', $aShortcutPrefs);
 
 				DisplayPreferences($oPage);

Vulnerable code: 						$aShortcutPrefs[$aShortcutKey['id']] = strtolower($sKey);
Fixed code: 						$aShortcutPrefs[$aShortcutKey['id']] = strtolower(utils::HtmlEntities($sKey));
CVE-2023-34447: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, on `pages/UI.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-10-25T18:17Z
Repository: https://github.com/Combodo/iTop
Language: PHP
Files changed: tests/php-unit-tests/unitary-tests/application/utilsTest.php
Commit date: 2023-06-05 14:50:37 +0200
Commit message: N°6348 - :white_check_mark: Add unit test

Diff: diff --git a/tests/php-unit-tests/unitary-tests/application/utilsTest.php b/tests/php-unit-tests/unitary-tests/application/utilsTest.php
index 17ee184788..fb55caeb96 100644
--- a/tests/php-unit-tests/unitary-tests/application/utilsTest.php
+++ b/tests/php-unit-tests/unitary-tests/application/utilsTest.php
@@ -829,10 +829,11 @@ class utilsTest extends ItopTestCase
 			'bad context_param'       => [utils::ENUM_SANITIZATION_FILTER_CONTEXT_PARAM, '%dssD,25_=%:+-', null],
 			'good element_identifier' => [utils::ENUM_SANITIZATION_FILTER_ELEMENT_IDENTIFIER, 'AD05nb', 'AD05nb'],
 			'bad element_identifier' => [utils::ENUM_SANITIZATION_FILTER_ELEMENT_IDENTIFIER, 'AD05nb+', 'AD05nb'],
 			'good url' => [utils::ENUM_SANITIZATION_FILTER_URL, 'https://www.w3schools.com', 'https://www.w3schools.com'],
 			'bad url' => [utils::ENUM_SANITIZATION_FILTER_URL, 'https://www.w3schoo��ls.co�m', null],
+			'url with injection' => [utils::ENUM_SANITIZATION_FILTER_URL, 'https://demo.combodo.com/simple/pages/UI.php?operation=full_text&text=<img zzz src=x onerror=alert(1) //>', null],
 			'raw_data' => ['raw_data', '<Test>\s😃😃😃', '<Test>\s😃😃😃'],
 		];
 	}
 
 	/**

Fixed code: 			'url with injection' => [utils::ENUM_SANITIZATION_FILTER_URL, 'https://demo.combodo.com/simple/pages/UI.php?operation=full_text&text=<img zzz src=x onerror=alert(1) //>', null],
CVE-2023-34447: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, on `pages/UI.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-10-25T18:17Z
Repository: https://github.com/Combodo/iTop
Language: PHP
Files changed: pages/UI.php
Commit date: 2023-06-01 16:44:40 +0200
Commit message: N°6348 - Hardening code

Diff: diff --git a/pages/UI.php b/pages/UI.php
index e838778644..f8ac61627d 100644
--- a/pages/UI.php
+++ b/pages/UI.php
@@ -567,12 +567,12 @@ try
 				// - Prepare label
 				$sQueryLabel = null;
 				if ($sQuery !== $sFullText) {
 					$sQueryLabel = $sFullText;
 				}
-				GlobalSearchHelper::AddQueryToHistory($sQuery, $sQueryIconUrl, $sQueryLabel);
-				$oP->SetBlockParam('ibo-global-search.sQuery', $sQuery);
+				GlobalSearchHelper::AddQueryToHistory(utils::EscapeHtml($sQuery), $sQueryIconUrl, $sQueryLabel);
+				$oP->SetBlockParam('ibo-global-search.sQuery', utils::EscapeHtml($sQuery));
 
 				// Check the needle length
 				$iMinLenth = MetaModel::GetConfig()->Get('full_text_needle_min');
 				foreach ($aFullTextNeedles as $sNeedle) {
 					if (strlen($sNeedle) < $iMinLenth) {

Vulnerable code: 				GlobalSearchHelper::AddQueryToHistory($sQuery, $sQueryIconUrl, $sQueryLabel);
				$oP->SetBlockParam('ibo-global-search.sQuery', $sQuery);
Fixed code: 				GlobalSearchHelper::AddQueryToHistory(utils::EscapeHtml($sQuery), $sQueryIconUrl, $sQueryLabel);
				$oP->SetBlockParam('ibo-global-search.sQuery', utils::EscapeHtml($sQuery));
CVE-2023-38511: Insufficient Information (NVD-CWE-noinfo)
value: iTop is an IT service management platform.  Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnerability is fixed in 3.0.4 and 3.1.1.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-15T17:15Z
Repository: https://github.com/Combodo/iTop
Language: PHP
Files changed: application/dashboard.class.inc.php
Commit date: 2023-09-15 09:55:51 +0200
Commit message: N°6581 - Security hardening

Diff: diff --git a/application/dashboard.class.inc.php b/application/dashboard.class.inc.php
index 2d6c7dbd447..3d2db1eb0ce 100644
--- a/application/dashboard.class.inc.php
+++ b/application/dashboard.class.inc.php
@@ -916,11 +916,11 @@ class RuntimeDashboard extends Dashboard
 	 */
 	public static function GetDashboardToEdit($sDashboardFile, $sDashBoardId)
 	{
 		$bCustomized = false;
 
-		$sDashboardFileSanitized = utils::RealPath($sDashboardFile, APPROOT);
+		$sDashboardFileSanitized = utils::RealPath(APPROOT.$sDashboardFile, APPROOT);
 		if (false === $sDashboardFileSanitized) {
 			throw new SecurityException('Invalid dashboard file !');
 		}
 
 		// Search for an eventual user defined dashboard
@@ -1139,11 +1139,11 @@ JS
 			->AddCSSClass('ibo-action-button');
 
 		$oToolbar->AddSubBlock($oActionButton);
 
 		$aActions = array();
-		$sFile = addslashes($this->sDefinitionFile);
+		$sFile = addslashes(utils::LocalPath($this->sDefinitionFile));
 		$sJSExtraParams = json_encode($aExtraParams);
 		if ($this->HasCustomDashboard()) {
 			$oEdit = new JSPopupMenuItem('UI:Dashboard:Edit', Dict::S('UI:Dashboard:EditCustom'), "return EditDashboard('{$this->sId}', '$sFile', $sJSExtraParams)");
 			$aActions[$oEdit->GetUID()] = $oEdit->GetMenuItem();
 			$oRevert = new JSPopupMenuItem('UI:Dashboard:RevertConfirm', Dict::S('UI:Dashboard:DeleteCustom'),

Vulnerable code: 		$sDashboardFileSanitized = utils::RealPath($sDashboardFile, APPROOT);
		$sFile = addslashes($this->sDefinitionFile);
Fixed code: 		$sDashboardFileSanitized = utils::RealPath(APPROOT.$sDashboardFile, APPROOT);
		$sFile = addslashes(utils::LocalPath($this->sDefinitionFile));
CVE-2023-38511: Insufficient Information (NVD-CWE-noinfo)
value: iTop is an IT service management platform.  Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnerability is fixed in 3.0.4 and 3.1.1.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-15T17:15Z
Repository: https://github.com/Combodo/iTop
Language: PHP
Files changed: application/dashboard.class.inc.php
Commit date: 2023-07-19 09:25:48 +0200
Commit message: N°6552 - Security hardening

Diff: diff --git a/application/dashboard.class.inc.php b/application/dashboard.class.inc.php
index b3fb736cfc1..2d6c7dbd447 100644
--- a/application/dashboard.class.inc.php
+++ b/application/dashboard.class.inc.php
@@ -916,10 +916,15 @@ class RuntimeDashboard extends Dashboard
 	 */
 	public static function GetDashboardToEdit($sDashboardFile, $sDashBoardId)
 	{
 		$bCustomized = false;
 
+		$sDashboardFileSanitized = utils::RealPath($sDashboardFile, APPROOT);
+		if (false === $sDashboardFileSanitized) {
+			throw new SecurityException('Invalid dashboard file !');
+		}
+
 		// Search for an eventual user defined dashboard
 		$oUDSearch = new DBObjectSearch('UserDashboard');
 		$oUDSearch->AddCondition('user_id', UserRights::GetUserId(), '=');
 		$oUDSearch->AddCondition('menu_code', $sDashBoardId, '=');
 		$oUDSet = new DBObjectSet($oUDSearch);
@@ -927,19 +932,19 @@ class RuntimeDashboard extends Dashboard
 			// Assuming there is at most one couple {user, menu}!
 			$oUserDashboard = $oUDSet->Fetch();
 			$sDashboardDefinition = $oUserDashboard->Get('contents');
 			$bCustomized = true;
 		} else {
-			$sDashboardDefinition = @file_get_contents($sDashboardFile);
+			$sDashboardDefinition = @file_get_contents($sDashboardFileSanitized);
 		}
 
 
 		if ($sDashboardDefinition !== false) {
 			$oDashboard = new RuntimeDashboard($sDashBoardId);
 			$oDashboard->FromXml($sDashboardDefinition);
 			$oDashboard->SetCustomFlag($bCustomized);
-			$oDashboard->SetDefinitionFile($sDashboardFile);
+			$oDashboard->SetDefinitionFile($sDashboardFileSanitized);
 		} else {
 			$oDashboard = null;
 		}
 
 		return $oDashboard;

Vulnerable code: 			$sDashboardDefinition = @file_get_contents($sDashboardFile);
			$oDashboard->SetDefinitionFile($sDashboardFile);
Fixed code: 		$sDashboardFileSanitized = utils::RealPath($sDashboardFile, APPROOT);
		if (false === $sDashboardFileSanitized) {
			throw new SecurityException('Invalid dashboard file !');
		}

			$sDashboardDefinition = @file_get_contents($sDashboardFileSanitized);
			$oDashboard->SetDefinitionFile($sDashboardFileSanitized);
CVE-2023-43790: Insufficient Information (NVD-CWE-noinfo)
value: iTop is an IT service management platform.  By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname value. This vulnerability is fixed in 3.1.1 and 3.2.0.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-15T17:15Z
Repository: https://github.com/Combodo/iTop
Language: Other
Files changed: templates/base/components/datatable/row-actions/handler.js.twig
Commit date: 2023-09-01 09:41:23 +0200
Commit message: N°6560 - Fix unescaped backtick in friendlyname breaking details page scripts

Diff: diff --git a/templates/base/components/datatable/row-actions/handler.js.twig b/templates/base/components/datatable/row-actions/handler.js.twig
index f2e8ff3a6b5..38c699f8c01 100644
--- a/templates/base/components/datatable/row-actions/handler.js.twig
+++ b/templates/base/components/datatable/row-actions/handler.js.twig
@@ -21,20 +21,20 @@
         {% endif %}
 
         {% if aAction.confirmation is defined %}
 
             // Prepare confirmation title
-            let sTitle = `{{ 'UI:Datatables:RowActions:ConfirmationDialog'|dict_s|raw  }}`;
+            let sTitle = '{{ 'UI:Datatables:RowActions:ConfirmationDialog'|dict_s  }}';
             {% if aAction.confirmation.title is defined %}
-                sTitle = `{{ aAction.confirmation.title|dict_s|raw }}`;
+                sTitle = '{{ aAction.confirmation.title|dict_s }}';
             {% endif %}
             sTitle = sTitle.replaceAll('{item}', aRowData['{{ aAction.confirmation.row_data }}']);
 
             // Prepare confirmation message
-            let sMessage = `{{ 'UI:Datatables:RowActions:ConfirmationMessage'|dict_s|raw  }}`;
+            let sMessage = '{{ 'UI:Datatables:RowActions:ConfirmationMessage'|dict_s  }}';
             {% if aAction.confirmation.message is defined %}
-                sMessage = `{{ aAction.confirmation.message|dict_s|raw }}`;
+                sMessage = '{{ aAction.confirmation.message|dict_s }}';
             {% endif %}
             sMessage = sMessage.replaceAll('{item}', aRowData['{{ aAction.confirmation.row_data }}']);
 
             // Handle action row with confirmation modal
             CombodoModal.OpenConfirmationModal({

Vulnerable code:             let sTitle = `{{ 'UI:Datatables:RowActions:ConfirmationDialog'|dict_s|raw  }}`;
                sTitle = `{{ aAction.confirmation.title|dict_s|raw }}`;
            let sMessage = `{{ 'UI:Datatables:RowActions:ConfirmationMessage'|dict_s|raw  }}`;
                sMessage = `{{ aAction.confirmation.message|dict_s|raw }}`;
Fixed code:             let sTitle = '{{ 'UI:Datatables:RowActions:ConfirmationDialog'|dict_s  }}';
                sTitle = '{{ aAction.confirmation.title|dict_s }}';
            let sMessage = '{{ 'UI:Datatables:RowActions:ConfirmationMessage'|dict_s  }}';
                sMessage = '{{ aAction.confirmation.message|dict_s }}';
CVE-2023-45808: Insufficient Information (NVD-CWE-noinfo)
value: iTop is an IT service management platform.  When creating or updating an object, extkey values aren't checked to be in the current user silo. In other words, by forging an http request, the user can create objects pointing to out of silo objects (for example a UserRequest in an out of scope Organization). Fixed in iTop 2.7.10, 3.0.4, 3.1.1, and 3.2.0.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-15T18:15Z
Repository: https://github.com/Combodo/iTop
Language: PHP
Files changed: datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php
Commit date: 2023-11-16 09:23:19 +0100
Commit message: N°6458 Fix portal errors

Diff: diff --git a/datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php b/datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php
index 21516082a63..329f4ba0654 100644
--- a/datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php
+++ b/datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php
@@ -30,11 +30,10 @@ use Combodo\iTop\Form\Field\FileUploadField;
 use Combodo\iTop\Form\Field\LabelField;
 use Combodo\iTop\Form\Form;
 use Combodo\iTop\Form\FormManager;
 use Combodo\iTop\Portal\Helper\ApplicationHelper;
 use Combodo\iTop\Portal\Helper\ObjectFormHandlerHelper;
-use Combodo\iTop\Portal\Helper\SecurityHelper;
 use CoreCannotSaveObjectException;
 use DBObject;
 use DBObjectSearch;
 use DBObjectSet;
 use DBSearch;
@@ -1134,15 +1133,14 @@ class ObjectFormManager extends FormManager
 			// modification flags
 			$bIsNew = $this->oObject->IsNew();
 			$bWasModified = $this->oObject->IsModified();
 			$bActivateTriggers = (!$bIsNew && $bWasModified);
 
-			/** @var SecurityHelper $oSecurityHelper */
-			$oSecurityHelper = $this->oContainer->get('security_helper');
+			$oSecurityHelper = $this->oFormHandlerHelper->getSecurityHelper();
 
 			// Forcing allowed writing on the object if necessary. This is used in some particular cases.
-			$bAllowWrite = $this->oFormHandlerHelper->getSecurityHelper()->IsActionAllowed($bIsNew ? UR_ACTION_CREATE : UR_ACTION_MODIFY, $sObjectClass, $this->oObject->GetKey());
+			$bAllowWrite = $oSecurityHelper->IsActionAllowed($bIsNew ? UR_ACTION_CREATE : UR_ACTION_MODIFY, $sObjectClass, $this->oObject->GetKey());
 			if ($bAllowWrite) {
 				$this->oObject->AllowWrite(true);
 			}
 
 			// Writing object to DB

Vulnerable code: use Combodo\iTop\Portal\Helper\SecurityHelper;
			/** @var SecurityHelper $oSecurityHelper */
			$oSecurityHelper = $this->oContainer->get('security_helper');
			$bAllowWrite = $this->oFormHandlerHelper->getSecurityHelper()->IsActionAllowed($bIsNew ? UR_ACTION_CREATE : UR_ACTION_MODIFY, $sObjectClass, $this->oObject->GetKey());
Fixed code: 			$oSecurityHelper = $this->oFormHandlerHelper->getSecurityHelper();
			$bAllowWrite = $oSecurityHelper->IsActionAllowed($bIsNew ? UR_ACTION_CREATE : UR_ACTION_MODIFY, $sObjectClass, $this->oObject->GetKey());
CVE-2023-48710: Insufficient Information (NVD-CWE-noinfo)
value: iTop is an IT service management platform.  Files from the `env-production` folder can be retrieved even though they should have restricted access.  Hopefully, there is no sensitive files stored in that folder natively, but there could be from a third-party module. 
 The `pages/exec.php` script as been fixed to limit execution of PHP files only.  Other file types won't be retrieved and exposed.  The vulnerability is fixed in 2.7.10, 3.0.4, 3.1.1, and 3.2.0.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-15T18:15Z
Repository: https://github.com/Combodo/iTop
Language: PHP
Files changed: pages/exec.php
Commit date: 2023-11-22 18:02:50 +0100
Commit message: N°6989 - Security hardening

Diff: diff --git a/pages/exec.php b/pages/exec.php
index 3db08bc6e9f..dd233aac8a4 100644
--- a/pages/exec.php
+++ b/pages/exec.php
@@ -46,12 +46,13 @@ session_start();
 $sEnvironment = utils::ReadParam('exec_env', utils::GetCurrentEnvironment());
 session_write_close();
 
 $sTargetPage = APPROOT.'env-'.$sEnvironment.'/'.$sModule.'/'.$sPage;
 
-if (!file_exists($sTargetPage))
-{
+if (!file_exists($sTargetPage)
+    || (strtolower(pathinfo($sTargetPage, PATHINFO_EXTENSION)) !== "php")
+) {
 	// Do not recall the parameters (security takes precedence)
 	echo "Wrong module, page name or environment...";
 	exit;
 }
 

Vulnerable code: if (!file_exists($sTargetPage))
{
Fixed code: if (!file_exists($sTargetPage)
    || (strtolower(pathinfo($sTargetPage, PATHINFO_EXTENSION)) !== "php")
) {
CVE-2014-125051: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in himiklab yii2-jqgrid-widget up to 1.0.7. It has been declared as critical. This vulnerability affects the function addSearchOptionsRecursively of the file JqGridAction.php. The manipulation leads to sql injection. Upgrading to version 1.0.8 is able to address this issue. The name of the patch is a117e0f2df729e3ff726968794d9a5ac40e660b9. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217564.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-06T17:15Z
Repository: https://github.com/himiklab/yii2-jqgrid-widget
Language: PHP
Files changed: JqGridAction.php
Commit date: 2014-10-06 16:34:39 +0400
Commit message: fix potential SQL injection

Diff: diff --git a/JqGridAction.php b/JqGridAction.php
index b89649e..05c55ba 100644
--- a/JqGridAction.php
+++ b/JqGridAction.php
@@ -257,10 +257,13 @@ class JqGridAction extends Action
                 throw new BadRequestHttpException('Unsupported value in `groupOp` param');
             }
         }
 
         foreach ($searchData['rules'] as $rule) {
+            if (!$this->model->hasAttribute($rule['field'])) {
+                throw new BadRequestHttpException('Unknown attribute');
+            }
             switch ($rule['op']) {
                 case 'eq':
                     $query->$groupCondition([$rule['field'] => $rule['data']]);
                     break;
                 case 'ne':

Fixed code:             if (!$this->model->hasAttribute($rule['field'])) {
                throw new BadRequestHttpException('Unknown attribute');
            }