hitoshura25/cvefixes huggingface dataset:
CVE-2022-29527 (Go, published 2022-04-20T10:15Z)
Description: value: Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local attackers to inject Sudo rules and escalate privileges to root. This occurs in certain situations involving a race condition.
Severity: MEDIUM (CVSS v3 base score: 7)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/aws/amazon-ssm-agent
Files changed:
agent/session/utility/utility_unix.go
Commit message: Create ssm-agent-users sudoer file with constrained file permission

cr: https://code.amazon.com/reviews/CR-67315538


Vulnerable code:
	sudoersFile     = "/etc/sudoers.d/ssm-agent-users"
	sudoersFileMode = 0440
	fs_ioc_getflags = uintptr(0x80086601)
	fs_ioc_setflags = uintptr(0x40086602)
	FS_APPEND_FL    = 0x00000020 /* writes to file may only append */
	FS_RESET_FL     = 0x00000000 /* reset file property */
	// Create a sudoers file for ssm-user
	file, err := os.Create(sudoersFile)
	fileMode := os.FileMode(sudoersFileMode)
		log.Errorf("Failed to change mode of %s to %d: %v", sudoersFile, sudoersFileMode, err)
	log.Infof("Successfully changed mode of %s to %d", sudoersFile, sudoersFileMode)

Fixed code:
	sudoersFile                = "/etc/sudoers.d/ssm-agent-users"
	sudoersFileCreateWriteMode = 0640
	sudoersFileReadOnlyMode    = 0440
	fs_ioc_getflags            = uintptr(0x80086601)
	fs_ioc_setflags            = uintptr(0x40086602)
	FS_APPEND_FL               = 0x00000020 /* writes to file may only append */
	FS_RESET_FL                = 0x00000000 /* reset file property */
	// Create a sudoers file for ssm-user with read/write access
	file, err := os.OpenFile(sudoersFile, os.O_WRONLY|os.O_CREATE, sudoersFileCreateWriteMode)
	fileMode := os.FileMode(sudoersFileReadOnlyMode)
		log.Errorf("Failed to change mode of %s to %d: %v", sudoersFile, sudoersFileReadOnlyMode, err)
	log.Infof("Successfully changed mode of %s to %d", sudoersFile, sudoersFileReadOnlyMode)
CVE-2021-32663 (PHP, published 2021-10-19T18:15Z)
Description: value: iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authentication. Given specific parameters this can lead to SSRF. This issue has been resolved in versions 2.6.5 and 2.7.5 and later
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/Combodo/iTop
Files changed:
setup/ajax.dataloader.php
setup/index.php
setup/setuputils.class.inc.php
setup/wizardcontroller.class.inc.php
setup/wizardsteps.class.inc.php
Commit message: N°3952 - code hardening (merged from support/2.6)


Vulnerable code:
-	echo "<p>An error happened while processing the installation:</p>\n";
 	echo '<p>'.$e."</p>\n";
 $oWizard->Run();
 
-			if (in_array('_'.$idx, $aParameters[count($aParameters)-1]))
-			{
-				foreach($aModuleInfo['modules'] as $sModuleName)
-				{
-		while($idx < count($aAdditionalModules) && (strlen($sImgUrl.'&m='.urlencode(implode(' ', $aReportedModules))) < 2000)) // reasonable limit for the URL: 2000 chars

Fixed code:
+	echo "<p>An error happened while processing the installation</p>\n";
 //N°3952
 if (SetupUtils::IsSessionSetupTokenValid()) {
 	// Normal operation
 	$oWizard->Run();
 } else {
+	SetupUtils::ExitMaintenanceMode(false);
 	// Force initializing the setup
 	$oWizard->Start();
 	SetupUtils::CreateSetupToken();
 }
 	/**
 	 * Check setup transaction and create a new one if necessary
 	 *
 	 * @return bool
 	 */
 	public static function IsSessionSetupTokenValid()
 	{
 		if (isset($_SESSION['setup_token'])) {
 			$sAuth = $_SESSION['setup_token'];
 			$sTokenFile = APPROOT.'data/setup/authent';
 			if (file_exists($sTokenFile) && $sAuth === file_get_contents($sTokenFile)) {
 				return true;
 			}
 		}
 
 		return false;
 	}
 
 	public static function EraseSetupToken()
 	{
 		$sTokenFile = APPROOT.'data/setup/authent';
 		if (is_file($sTokenFile)) {
 			unlink($sTokenFile);
 		}
 		unset($_SESSION['setup_token']);
 	}
+
 					SetupUtils::EraseSetupToken();
+			if (in_array('_'.$idx, $aParameters[count($aParameters)-1])) {
+				foreach ($aModuleInfo['modules'] as $sModuleName) {
+		while ($idx < count($aAdditionalModules) && (strlen($sImgUrl.'&m='.urlencode(implode(' ', $aReportedModules))) < 2000)) // reasonable limit for the URL: 2000 chars
CVE-2021-32664 (PHP, published 2021-10-19T18:15Z)
Description: value: Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Combodo/iTop
Files changed:
pages/run_query.php
Commit message: N°4002 - code hardening


Vulnerable code:
		$sClearText = base64_decode($sExpression);

Fixed code:
CVE-2021-32664 (Unknown, published 2021-10-19T18:15Z)
Description: value: Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Combodo/iTop
Files changed:
Commit message: N°4002 - code hardening (merge from support/2.6)


Vulnerable code:

Fixed code:
CVE-2021-32664 (PHP, published 2021-10-19T18:15Z)
Description: value: Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Combodo/iTop
Files changed:
pages/run_query.php
Commit message: N°4002 - code hardening


Vulnerable code:
		echo "<strong>FYI: '$sClearText'</strong><br/>\n";

Fixed code:
CVE-2021-41161 (PHP, published 2022-04-21T17:15Z)
Description: value: Combodo iTop is a web based IT Service Management tool. In versions prior to 3.0.0-beta6 the export CSV page don't properly escape the user supplied parameters, allowing for javascript injection into rendered csv files. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Combodo/iTop
Files changed:
pages/csvimport.php
Commit message: N°4361 - XSS in csvimport on develop


Vulnerable code:
		if (UserRights::IsActionAllowed($sClassName, UR_ACTION_MODIFY) == UR_ALLOWED_NO)
		{
		if (utils::ReadParam('box_skiplines', '0') == 1)
		{
			
		$sCSVData = utils::ReadParam('csvdata', '', false, 'raw_data');

Fixed code:
		if (UserRights::IsActionAllowed($sClassName, UR_ACTION_MODIFY) == UR_ALLOWED_NO) {
		if (utils::ReadParam('box_skiplines', '0') == 1) {

		$sCSVData = utils::ReadParam('csvdata', '', false, utils::ENUM_SANITIZATION_FILTER_STRING);
CVE-2021-41162 (PHP, published 2022-04-21T17:15Z)
Description: value: Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to beta6 the `ajax.render.php?operation=wizard_helper` page did not properly escape the user supplied parameters, allowing for a cross site scripting attack vector. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Combodo/iTop
Files changed:
application/wizardhelper.class.inc.php
Commit message: N°4362 - XSS in ajax.render.php?operation=wizard_helper on develop


Vulnerable code:
		$sWizardHelperJsVar = (!is_null($this->m_aData['m_sWizHelperJsVarName'])) ? utils::Sanitize($this->m_aData['m_sWizHelperJsVarName'], utils::ENUM_SANITIZATION_FILTER_PARAMETER) : 'oWizardHelper'.$this->GetFormPrefix();
		//str_replace(['(', ')', ';'], '', $this->m_aData['m_sWizHelperJsVarName']) : 'oWizardHelper'.$this->GetFormPrefix();

Fixed code:
		$sWizardHelperJsVar = (!is_null($this->m_aData['m_sWizHelperJsVarName'])) ? utils::Sanitize($this->m_aData['m_sWizHelperJsVarName'], '', utils::ENUM_SANITIZATION_FILTER_PARAMETER) : 'oWizardHelper'.$this->GetFormPrefix();
CVE-2022-24780 (PHP, published 2022-04-05T19:15Z)
Description: value: Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/Combodo/iTop
Files changed:
datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php
Commit message: N°4384 Fix PHP warning when decoding formmanager_data when it is already in a PHP array form


Vulnerable code:
		if (is_array($sJson)) {
			$aJson = $sJson;
		} else {
			$aJson = json_decode($sJson, true);
		}
		$aPostedFormManagerData = json_decode($sPostedFormManagerData, true);

Fixed code:
	 *
	/**
	 * @param string|array $formManagerData value of the formmanager_data portal parameter, either JSON or object
	 *
	 * @return array formmanager_data as a PHP array
	 *
	 * @since 2.7.6 3.0.0 N°4384 method creation : factorize as this is used twice now
	 */
	protected static function DecodeFormManagerData($formManagerData)
	{
		if (is_array($formManagerData)) {
			return $formManagerData;
		}

		return json_decode($formManagerData, true);
	}

		$aJson = static::DecodeFormManagerData($sJson);
		$aPostedFormManagerData = static::DecodeFormManagerData($sPostedFormManagerData);
CVE-2022-24780 (PHP, published 2022-04-05T19:15Z)
Description: value: Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/Combodo/iTop
Files changed:
datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php
datamodels/2.x/itop-tickets/datamodel.itop-tickets.xml
Commit message: N°4384 Security hardening
Module parameter flag for extensions


Vulnerable code:
	 * Creates an instance of \Combodo\iTop\Portal\Form\ObjectFormManager from JSON data that must contain at least :
	 * - formobject_class : The class of the object that is being edited/viewed
	 * - formmode : view|edit|create
	 * - values for parent
	 * @param bool $bTrustContent if false then won't allow TWIG content
		if (false === $bTrustContent) {

Fixed code:
	 * @param string $sJson JSON data that must contain at least :
	 *       - formobject_class : The class of the object that is being edited/viewed
	 *       - formmode : view|edit|create
	 *       - values for parent
	 * @param bool $bTrustContent if false then won't allow modified TWIG content
	 * @return \Combodo\iTop\Portal\Form\ObjectFormManager new instance init from JSON data
	 *
	 * @since 2.7.6 3.0.0 N°4384 new $bTrustContent parameter
		$oConfig = utils::GetConfig();
		$bIsContentCheckEnabled = $oConfig->GetModuleSetting(PORTAL_ID, 'enable_formmanager_content_check', true);
		if ($bIsContentCheckEnabled && (false === $bTrustContent)) {
      <enable_formmanager_content_check type="boolean">true</enable_formmanager_content_check>
CVE-2022-24811 (PHP, published 2022-04-05T19:15Z)
Description: value: Combodi iTop is a web based IT Service Management tool. Prior to versions 2.7.6 and 3.0.0, cross-site scripting is possible for scripts outside of script tags when displaying HTML attachments. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Combodo/iTop
Files changed:
core/config.class.inc.php
datamodels/2.x/itop-portal-base/portal/src/controllers/objectcontroller.class.inc.php
pages/ajax.render.php
Commit message: N°4129 - Security hardening


Vulnerable code:
				$oPage->add_header('X-Frame-Options:'); // resets header, see N°3416

Fixed code:
		'security.disable_inline_documents_sandbox' => array(
			'type' => 'bool',
			'description' => 'If true then the sandbox for documents displayed in a browser tab will be disabled; enabling scripts and other interactive content. Note that setting this to true will open the application to potential XSS attacks!',
			'default' => false,
			'value' => false,
			'source_of_value' => '',
			'show_in_conf_sample' => false,
		),
	    // N°4129 - Prevent XSS attacks & other script executions
	    if (utils::GetConfig()->Get('security.disable_inline_documents_sandbox') === false) {
		    $aHeaders['Content-Security-Policy'] = 'sandbox';
	    }

				// Resets header, see N°3416
				$oPage->add_header('X-Frame-Options:');
				// N°4129 - Prevent XSS attacks & other script executions
				if (utils::GetConfig()->Get('security.disable_inline_documents_sandbox') === false) {
					$oPage->add_header('Content-Security-Policy: sandbox;');
				}
CVE-2022-39214 (PHP, published 2023-03-14T16:15Z)
Description: value: Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, a user who can log in on iTop is able to take over any account just by knowing the account's username. This issue is fixed in versions 2.7.8 and 3.0.2-1.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/Combodo/iTop
Files changed:
application/loginbasic.class.inc.php
application/loginexternal.class.inc.php
application/loginform.class.inc.php
application/loginurl.class.inc.php
Commit message: N°5394 - use session for the FSM (use Session object)


Vulnerable code:
				$_SESSION['auth_user'] = $sAuthUser;
				$_SESSION['auth_user'] = $sAuthUser;
				$_SESSION['auth_user'] = $sAuthUser;
				$_SESSION['auth_user'] = $sAuthUser;

Fixed code:
CVE-2022-39214 (PHP, published 2023-03-14T16:15Z)
Description: value: Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, a user who can log in on iTop is able to take over any account just by knowing the account's username. This issue is fixed in versions 2.7.8 and 3.0.2-1.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/Combodo/iTop
Files changed:
application/loginbasic.class.inc.php
application/loginexternal.class.inc.php
application/loginform.class.inc.php
application/loginurl.class.inc.php
Commit message: N°5394 - use session for the FSM


Vulnerable code:
			list($sAuthUser) = $this->GetAuthUserAndPassword();
			$sAuthUser = $this->GetAuthUser();
			if (isset($_SESSION['auth_user']))
			{
				// If FSM reenter this state (example 2FA) then the auth_user is not resubmitted
				$sAuthUser = $_SESSION['auth_user'];
			}
			else
			{
				$sAuthUser = utils::ReadPostedParam('auth_user', '', 'raw_data');
			}
			$sAuthUser = utils::ReadParam('auth_user', '', false, 'raw_data');

Fixed code:
			// Save the checked user
			$_SESSION['auth_user'] = $sAuthUser;
			$sAuthUser = $_SESSION['auth_user'];
			// Save the checked user
			$_SESSION['auth_user'] = $sAuthUser;
			$sAuthUser = $_SESSION['auth_user'];
			// Save the checked user
			$_SESSION['auth_user'] = $sAuthUser;
			$sAuthUser = $_SESSION['auth_user'];
			// Save the checked user
			$_SESSION['auth_user'] = $sAuthUser;
			$sAuthUser = $_SESSION['auth_user'];
CVE-2022-39216 (PHP, published 2023-03-14T16:15Z)
Description: value: Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, the reset password token is generated without any randomness parameter. This may lead to account takeover. The issue is fixed in versions 2.7.8 and 3.0.2-1.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-330 \u2014 Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Repository: https://github.com/Combodo/iTop
Files changed:
application/loginwebpage.class.inc.php
Commit message: N°5393 Security hardening


Vulnerable code:
				$sToken = substr(md5(APPROOT.uniqid()), 0, 16);

Fixed code:
				$sToken = bin2hex(random_bytes(32));
CVE-2023-34446 (PHP, published 2023-10-25T18:17Z)
Description: value: iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, when displaying `pages/preferences.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0.

Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Combodo/iTop
Files changed:
pages/preferences.php
Commit message: N°6349 - Hardening code


Vulnerable code:
						$aShortcutPrefs[$aShortcutKey['id']] = strtolower($sKey);

Fixed code:
						$aShortcutPrefs[$aShortcutKey['id']] = strtolower(utils::HtmlEntities($sKey));
CVE-2023-34447 (PHP, published 2023-10-25T18:17Z)
Description: value: iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, on `pages/UI.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Combodo/iTop
Files changed:
tests/php-unit-tests/unitary-tests/application/utilsTest.php
Commit message: N°6348 - :white_check_mark: Add unit test


Vulnerable code:

Fixed code:
			'url with injection' => [utils::ENUM_SANITIZATION_FILTER_URL, 'https://demo.combodo.com/simple/pages/UI.php?operation=full_text&text=<img zzz src=x onerror=alert(1) //>', null],
CVE-2023-34447 (PHP, published 2023-10-25T18:17Z)
Description: value: iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, on `pages/UI.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Combodo/iTop
Files changed:
pages/UI.php
Commit message: N°6348 - Hardening code


Vulnerable code:
				GlobalSearchHelper::AddQueryToHistory($sQuery, $sQueryIconUrl, $sQueryLabel);
				$oP->SetBlockParam('ibo-global-search.sQuery', $sQuery);

Fixed code:
				GlobalSearchHelper::AddQueryToHistory(utils::EscapeHtml($sQuery), $sQueryIconUrl, $sQueryLabel);
				$oP->SetBlockParam('ibo-global-search.sQuery', utils::EscapeHtml($sQuery));
CVE-2023-38511 (PHP, published 2024-04-15T17:15Z)
Description: value: iTop is an IT service management platform.  Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnerability is fixed in 3.0.4 and 3.1.1.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Combodo/iTop
Files changed:
application/dashboard.class.inc.php
Commit message: N°6581 - Security hardening


Vulnerable code:
		$sDashboardFileSanitized = utils::RealPath($sDashboardFile, APPROOT);
		$sFile = addslashes($this->sDefinitionFile);

Fixed code:
		$sDashboardFileSanitized = utils::RealPath(APPROOT.$sDashboardFile, APPROOT);
		$sFile = addslashes(utils::LocalPath($this->sDefinitionFile));