CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-52000 – Reflected Cross-site Scripting exploit in Combodo iTop
https://notcve.org/view.php?id=CVE-2024-52000
Combodo iTop is a simple, web based IT Service Management tool. Affected versions are subject to a reflected Cross-site Scripting (XSS) exploit by way of editing a request's payload which can lead to malicious javascript execution. This issue has been addressed in version 3.2.0 via systematic escaping of error messages when rendering on the page. All users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/Combodo/iTop/security/advisories/GHSA-r58g-p5r9-8hfg • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-52001 – Portal user is able to access forbidden services information in Combodo iTop
https://notcve.org/view.php?id=CVE-2024-52001
Combodo iTop is a simple, web based IT Service Management tool. In affected versions portal users are able to access forbidden services information. This issue has been addressed in version 3.2.0. All users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/Combodo/iTop/security/advisories/GHSA-9p26-v3wj-6q34 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2024-52002 – Cross-Site Request Forgery (CSRF) in several iTop pages
https://notcve.org/view.php?id=CVE-2024-52002
Combodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to a Cross-Site Request Forgery (CSRF) vulnerability. Please refer to the linked GHSA for the complete list. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/Combodo/iTop/security/advisories/GHSA-xr4x-xq7v-7gqm • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 3.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-51993 – Password is stored in clear in the database in Combodo iTop
https://notcve.org/view.php?id=CVE-2024-51993
Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for misconfigured Users. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. Users unable to upgrade are advised to encrypt their backups independently of the iTop application. ### Patches Sanitize parameter ### References N°7631 - Password is stored in clear in the database. • https://github.com/Combodo/iTop/security/advisories/GHSA-9mq5-349x-x427 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-51994 – Cross-site Scripting in portal picture upload in Combodo iTop
https://notcve.org/view.php?id=CVE-2024-51994
Combodo iTop is a web based IT Service Management tool. In affected versions uploading a text file containing some java script in the portal will trigger an Cross-site Scripting (XSS) vulnerability. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/Combodo/iTop/security/advisories/GHSA-jjph-c25g-5c7g • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •