CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-52001 – Portal user is able to access forbidden services information in Combodo iTop
https://notcve.org/view.php?id=CVE-2024-52001
08 Nov 2024 — Combodo iTop is a simple, web based IT Service Management tool. In affected versions portal users are able to access forbidden services information. This issue has been addressed in version 3.2.0. All users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/Combodo/iTop/security/advisories/GHSA-9p26-v3wj-6q34 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.0EPSS: 1%CPEs: 1EXPL: 1CVE-2024-52002 – Cross-Site Request Forgery (CSRF) in several iTop pages
https://notcve.org/view.php?id=CVE-2024-52002
08 Nov 2024 — Combodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to a Cross-Site Request Forgery (CSRF) vulnerability. Please refer to the linked GHSA for the complete list. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/Harshit-Mashru/iTop-CVEs-exploit • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 3.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-51993 – Password is stored in clear in the database in Combodo iTop
https://notcve.org/view.php?id=CVE-2024-51993
07 Nov 2024 — Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for misconfigured Users. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. Users unable to upgrade are advised to encrypt their backups independently of the iTop application. ### Patches Sanitize parameter ### References N°7631 - Password is stored in clear in the database. Combodo iTop is a web based IT Service Management tool. • https://github.com/Combodo/iTop/security/advisories/GHSA-9mq5-349x-x427 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-51994 – Cross-site Scripting in portal picture upload in Combodo iTop
https://notcve.org/view.php?id=CVE-2024-51994
07 Nov 2024 — Combodo iTop is a web based IT Service Management tool. In affected versions uploading a text file containing some java script in the portal will trigger an Cross-site Scripting (XSS) vulnerability. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/Combodo/iTop/security/advisories/GHSA-jjph-c25g-5c7g • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-51995 – Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTop
https://notcve.org/view.php?id=CVE-2024-51995
07 Nov 2024 — Combodo iTop is a web based IT Service Management tool. An attacker can request any `route` we want as long as we specify an `operation` that is allowed. This issue has been addressed in version 3.2.0 by applying the same access control pattern as in `UI.php` to the `ajax.render.php` page which does not allow arbitrary `routes` to be dispatched. All users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/Combodo/iTop/security/advisories/GHSA-3mxr-8r3j-j2j9 • CWE-284: Improper Access Control •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-51740 – SSRF through arbitrary PHP class instantiation in the user portal in Combodo iTop
https://notcve.org/view.php?id=CVE-2024-51740
05 Nov 2024 — Combodo iTop is a simple, web based IT Service Management tool. This vulnerability can be used to create HTTP requests on behalf of the server, from a low privileged user. The user portal form manager has been fixed to only instantiate classes derived from it. This issue has been addressed in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. • https://github.com/Combodo/iTop/security/advisories/GHSA-w9g8-mxm5-ph62 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.8EPSS: 48%CPEs: 3EXPL: 0CVE-2024-51739 – Users enumeration allowed through Rest API in Combodo iTop
https://notcve.org/view.php?id=CVE-2024-51739
05 Nov 2024 — Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a valid account. As a fix the sentence displayed after resetting password no longer shows if the user exists or not. This fix is included in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. • https://github.com/Combodo/iTop/security/advisories/GHSA-2hmf-p27w-phf9 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.8EPSS: 9%CPEs: 3EXPL: 0CVE-2024-32870 – iTop hub connector Information disclosure
https://notcve.org/view.php?id=CVE-2024-32870
04 Nov 2024 — Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info (name, version and parameters) can be read by anyone having access to iTop URI. This issue has been patched in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/Combodo/iTop/security/advisories/GHSA-rfjh-2f5x-qxmx • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31998 – CSRF security issue on CSV import in Combodo iTop
https://notcve.org/view.php?id=CVE-2024-31998
04 Nov 2024 — Combodo iTop is a simple, web based IT Service Management tool. A CSRF can be performed on CSV import simulation. This issue has been fixed in versions 3.1.2 and 3.2.0. All users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/Combodo/iTop/security/advisories/GHSA-8cwx-q4xh-7c7r • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31448 – Cross-site Scripting vulnerability in link CSV import in Combodo iTop
https://notcve.org/view.php?id=CVE-2024-31448
04 Nov 2024 — Combodo iTop is a simple, web based IT Service Management tool. By filling malicious code in a CSV content, an Cross-site Scripting (XSS) attack can be performed when importing this content. This issue has been fixed in versions 3.1.2 and 3.2.0. All users are advised to upgrade. Users unable to upgrade should validate CSV content before importing it. • https://github.com/Combodo/iTop/security/advisories/GHSA-776w-x6v7-vfwf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •