CVE-2020-15220 : What You Need to Know

Combodo iTop before versions 2.7.2 and 3.0.0 is vulnerable to session fixation, allowing attackers to steal user sessions.

Understanding CVE-2020-15220

In this CVE, a web-based IT Service Management tool, Combodo iTop, is affected by a session fixation vulnerability.

What is CVE-2020-15220?

Combodo iTop versions prior to 2.7.2 and 3.0.0 create two cookies for the same session, enabling potential session theft.

The Impact of CVE-2020-15220

CVSS Base Score: 6.1 (Medium Severity)
Attack Vector: Network
Attack Complexity: Low
User Interaction: Required
Scope: Changed
Confidentiality and Integrity Impact: Low
Privileges Required: None
Availability Impact: None

Technical Details of CVE-2020-15220

This section provides more in-depth technical insights into the vulnerability.

Vulnerability Description

The vulnerability arises from the creation of two cookies for the same session in Combodo iTop versions before 2.7.2 and 3.0.0.

Affected Systems and Versions

Affected Product: iTop
Vendor: Combodo
Vulnerable Versions: < 2.7.2

Exploitation Mechanism

Attackers can exploit this vulnerability to steal user sessions by fixing the session to a known value.

Mitigation and Prevention

Protect your systems from CVE-2020-15220 with these mitigation strategies.

Immediate Steps to Take

Upgrade iTop to version 2.7.2 or 3.0.0, where the vulnerability is fixed.
Monitor user sessions for any suspicious activities.

Long-Term Security Practices

Implement strong session management practices to prevent session fixation attacks.
Regularly update and patch your IT Service Management tools.
Conduct security audits to identify and address potential vulnerabilities.