CVE-2020-15218: Admin pages are cached and can be embedded

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-01-13 · updated 2026-06-17
Weakness: CWE-613

Description

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, admin pages are cached, so that their content is visible after deconnection by using the browser back button. This is fixed in versions 2.7.2 and 3.0.0.

Affected products

Combodo iTop: before 2.7.2; 3.0.0-alpha — fixed in 2.7.2

How to fix

Upgrade to a fixed version: Combodo iTop 2.7.2. Check the vendor advisory for mitigations.

References

https://github.com/Combodo/iTop/security/advisories/GHSA-3m3g-86hp-5p2j
https://github.com/Combodo/iTop/security/advisories/GHSA-3m3g-86hp-5p2j

Get alerted when CVE-2020-15218 or the next vulnerability affects your stack