iTop Vulnerability: HTTP Requests from Low-Privileged Users
CVE-2024-51740

8.8HIGH

Key Information:

Vendor

Combodo

Status
Itop
Vendor
CVE Published:
5 November 2024

What is CVE-2024-51740?

A remote code execution vulnerability exists in Combodo iTop, a widely used web-based IT service management tool. This flaw allows a low-privileged user to craft HTTP requests that the server processes, potentially resulting in unauthorized actions. The vulnerability has been mitigated in the latest versions of iTop, specifically 2.7.11, 3.0.5, 3.1.2, and 3.2.0. It is critical for users to upgrade to these versions as there are no viable workarounds. For more details, visit the official advisory at Combodo's GitHub repository.

Affected Version(s)

iTop < 2.7.11 < 2.7.11

iTop >= 3.0.0, < 3.0.5 < 3.0.0, 3.0.5

iTop >= 3.1.0, < 3.1.2 < 3.1.0, 3.1.2

References

https://github.com/Combodo/iTop/security/advisories/GHSA-...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.