CVSS: 9.6EPSS: 2%CPEs: 2EXPL: 0CVE-2022-39214 – Authenticated users of Combodo iTop can take over any account
https://notcve.org/view.php?id=CVE-2022-39214
14 Mar 2023 — Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, a user who can log in on iTop is able to take over any account just by knowing the account's username. This issue is fixed in versions 2.7.8 and 3.0.2-1. • https://github.com/Combodo/iTop/commit/4c1df9927d1dc6b0181ee20721f93346def026fd • CWE-863: Incorrect Authorization •
CVSS: 9.3EPSS: 0%CPEs: 7EXPL: 0CVE-2021-41162 – Cross-site Scripting in Combodo iTop
https://notcve.org/view.php?id=CVE-2021-41162
21 Apr 2022 — Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to beta6 the `ajax.render.php?operation=wizard_helper` page did not properly escape the user supplied parameters, allowing for a cross site scripting attack vector. Users are advised to upgrade. There are no known workarounds for this issue. • https://github.com/Combodo/iTop/commit/83125d9ae16cfb2527b9d0ab0805a68b863244a0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.7EPSS: 0%CPEs: 2EXPL: 1CVE-2022-24870 – Stored Cross-site Scripting in Combodo iTop
https://notcve.org/view.php?id=CVE-2022-24870
21 Apr 2022 — Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to 3.0.0 beta3 a malicious script can be injected in tooltips using iTop customization mechanism. This provides a stored cross site scripting attack vector to authorized users of the system. Users are advised to upgrade. There are no known workarounds for this issue. • https://github.com/Combodo/iTop/security/advisories/GHSA-29h7-jw2p-pcw3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 0%CPEs: 6EXPL: 0CVE-2021-41161 – XSS in csvimport in 3.0.0-beta versions
https://notcve.org/view.php?id=CVE-2021-41161
21 Apr 2022 — Combodo iTop is a web based IT Service Management tool. In versions prior to 3.0.0-beta6 the export CSV page don't properly escape the user supplied parameters, allowing for javascript injection into rendered csv files. Users are advised to upgrade. There are no known workarounds for this issue. Combodo iTop es una herramienta de administración de servicios de TI basada en la web. • https://github.com/Combodo/iTop/commit/c8f3d23d30c018bc44189b38fa34a5fffb4edb22 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 16%CPEs: 12EXPL: 4CVE-2022-24780 – Code Injection in Combodo iTop
https://notcve.org/view.php?id=CVE-2022-24780
05 Apr 2022 — Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds. Combodo iTop es una herramienta de Administración de Servicios de TI basada en la web. • https://packetstorm.news/files/id/167236 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-32776 – No CSRF form token cleanup on Windows servers
https://notcve.org/view.php?id=CVE-2021-32776
21 Jul 2021 — Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Windows servers no cleanup is done on CSRF tokens. This issue is fixed in versions 2.7.4 and 3.0.0. Combodo iTop es una herramienta de Administración de servicios de TI basada en la web. En versiones anteriores a 2.7.4, los tokens CSRF pueden ser reusados por un usuario malicioso, ya que en los servidores Windows no se realiza una limpieza de los tokens CSRF. • https://github.com/Combodo/iTop/security/advisories/GHSA-cxw7-2x7h-f7pr • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.7EPSS: 0%CPEs: 4EXPL: 0CVE-2021-32775 – Any user can see any fields (including mailbox password) with GroupBy Dashlet
https://notcve.org/view.php?id=CVE-2021-32775
21 Jul 2021 — Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field values through GroupBy Dashlet error message. This issue is fixed in versions 2.7.4 and 3.0.0. Combodo iTop es una herramienta de Administración de Servicios de TI basada en la web. En versiones anteriores a 2.7.4, un usuario no administrador puede acceder a muchos valores de clase/campo mediante el mensaje de error GroupBy Dashlet. • https://github.com/Combodo/iTop/security/advisories/GHSA-xh7w-rrp3-fhpq • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-15221 – XSS in the breadcrumbs
https://notcve.org/view.php?id=CVE-2020-15221
13 Jan 2021 — Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, by modifying target browser local storage, an XSS can be generated in the iTop console breadcrumb. This is fixed in versions 2.7.2 and 3.0.0. Combodo iTop es una herramienta de Administración de Servicios de TI basada en web. En iTop versiones anteriores a 2.7.2 y 3.0.0, al modificar el almacenamiento local del navegador de destino, una vulnerabilidad de tipo XSS puede ser generada en la ruta de navegación ... • https://github.com/Combodo/iTop/security/advisories/GHSA-w6g2-p7pf-7hvw • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-15220 – Session fixation
https://notcve.org/view.php?id=CVE-2020-15220
13 Jan 2021 — Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, two cookies are created for the same session, which leads to a possibility to steal user session. This is fixed in versions 2.7.2 and 3.0.0. Combodo iTop es una herramienta de Administración de Servicios de TI basada en web. En iTop versiones anteriores a 2.7.2 y 3.0.0, dos cookies son creadas para la misma sesión, lo que conlleva a la posibilidad de robar una sesión de usuario. • https://github.com/Combodo/iTop/security/advisories/GHSA-qw4q-cmcv-7vv2 • CWE-613: Insufficient Session Expiration •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-15219 – SQL query displayed on portal error
https://notcve.org/view.php?id=CVE-2020-15219
13 Jan 2021 — Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, when a download error is triggered in the user portal, an SQL query is displayed to the user. This is fixed in versions 2.7.2 and 3.0.0. Combodo iTop es una herramienta de Administración de Servicios de TI basada en web. En iTop versiones anteriores a 2.7.2 y 3.0.0, cuando un error de descarga es activado en el portal del usuario, una consulta SQL es mostrada al usuario. • https://github.com/Combodo/iTop/security/advisories/GHSA-q5cf-46rg-frf8 • CWE-209: Generation of Error Message Containing Sensitive Information •