CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-41245 – Possible Cross-Site Request Forgery in Combodo iTop
https://notcve.org/view.php?id=CVE-2021-41245
Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, CSRF tokens generated by `privUITransactionFile` aren't properly checked. Versions 2.7.6 and 3.0.0 contain a patch for this issue. As a workaround, use the session implementation by adding in the iTop config file. Combodo iTop es una herramienta de administración de servicios de TI basada en la web. • https://github.com/Combodo/iTop/commit/7757f1f2d2330d49a3ebb40194f5ec4c8eaf8186 https://github.com/Combodo/iTop/security/advisories/GHSA-33pr-5776-9jqf https://huntr.dev/bounties/0a39630d-f4b9-4468-86d8-aea3b02f91ae • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-32664 – Reflected XSS in Combodo/iTop
https://notcve.org/view.php?id=CVE-2021-32664
Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5. Combodo iTop es una herramienta de Administración de Servicios de TI de código abierto basada en la web. En las versiones afectadas se presenta una vulnerabilidad de tipo XSS en la página "run query" cuando se inicia la sesión como administrador. • https://github.com/Combodo/iTop/commit/4f5c987d8b1bd12814dc606ea69b6cfb88490704 https://github.com/Combodo/iTop/commit/84741c19f0af6fa8e7082a8807eb089182e7b88a https://github.com/Combodo/iTop/commit/86f649affc12b5078efc86d9439d67d98f4cb2f6 https://github.com/Combodo/iTop/security/advisories/GHSA-j758-ggwg-9mpj • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.7EPSS: 0%CPEs: 2EXPL: 0CVE-2021-32663 – Unauthorized setup leads to SSRF in Combodo/iTop
https://notcve.org/view.php?id=CVE-2021-32663
iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authentication. Given specific parameters this can lead to SSRF. This issue has been resolved in versions 2.6.5 and 2.7.5 and later iTop es una herramienta de Administración de Servicios de TI de código abierto basada en la web. En las versiones afectadas un atacante puede llamar a la configuración del sistema sin autenticación. • https://github.com/Combodo/iTop/commit/43daa2ef088bf928a2386fa19324628c3f19b807 https://github.com/Combodo/iTop/commit/6be9a87c150978752bc68baae1a5c4833ddadfec https://github.com/Combodo/iTop/security/advisories/GHSA-ghqc-r8f6-q9m9 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-32776 – No CSRF form token cleanup on Windows servers
https://notcve.org/view.php?id=CVE-2021-32776
Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Windows servers no cleanup is done on CSRF tokens. This issue is fixed in versions 2.7.4 and 3.0.0. Combodo iTop es una herramienta de Administración de servicios de TI basada en la web. En versiones anteriores a 2.7.4, los tokens CSRF pueden ser reusados por un usuario malicioso, ya que en los servidores Windows no se realiza una limpieza de los tokens CSRF. • https://github.com/Combodo/iTop/security/advisories/GHSA-cxw7-2x7h-f7pr • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.7EPSS: 0%CPEs: 4EXPL: 0CVE-2021-32775 – Any user can see any fields (including mailbox password) with GroupBy Dashlet
https://notcve.org/view.php?id=CVE-2021-32775
Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field values through GroupBy Dashlet error message. This issue is fixed in versions 2.7.4 and 3.0.0. Combodo iTop es una herramienta de Administración de Servicios de TI basada en la web. En versiones anteriores a 2.7.4, un usuario no administrador puede acceder a muchos valores de clase/campo mediante el mensaje de error GroupBy Dashlet. • https://github.com/Combodo/iTop/security/advisories/GHSA-xh7w-rrp3-fhpq • CWE-209: Generation of Error Message Containing Sensitive Information •