CVSS: 8.8EPSS: 1%CPEs: 12EXPL: 3CVE-2022-24780 – Code Injection in Combodo iTop
https://notcve.org/view.php?id=CVE-2022-24780
Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds. Combodo iTop es una herramienta de Administración de Servicios de TI basada en la web. • https://github.com/Acceis/exploit-CVE-2022-24780 http://packetstormsecurity.com/files/167236/iTop-Remote-Command-Execution.html https://github.com/Combodo/iTop/commit/93f273a28778e5da8e51096f021d2dc1adbf4ef3 https://github.com/Combodo/iTop/commit/b6fac4b411b8d145fc30fa35c66b51243eafd06b https://github.com/Combodo/iTop/commit/eb2a615bd28100442c7f6171707bb40884af2305 https://github.com/Combodo/iTop/security/advisories/GHSA-v97m-wgxq-rh54 https://markus-krell.de/itop-template-injection-inside-customer-portal • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-41245 – Possible Cross-Site Request Forgery in Combodo iTop
https://notcve.org/view.php?id=CVE-2021-41245
Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, CSRF tokens generated by `privUITransactionFile` aren't properly checked. Versions 2.7.6 and 3.0.0 contain a patch for this issue. As a workaround, use the session implementation by adding in the iTop config file. Combodo iTop es una herramienta de administración de servicios de TI basada en la web. • https://github.com/Combodo/iTop/commit/7757f1f2d2330d49a3ebb40194f5ec4c8eaf8186 https://github.com/Combodo/iTop/security/advisories/GHSA-33pr-5776-9jqf https://huntr.dev/bounties/0a39630d-f4b9-4468-86d8-aea3b02f91ae • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-32776 – No CSRF form token cleanup on Windows servers
https://notcve.org/view.php?id=CVE-2021-32776
Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Windows servers no cleanup is done on CSRF tokens. This issue is fixed in versions 2.7.4 and 3.0.0. Combodo iTop es una herramienta de Administración de servicios de TI basada en la web. En versiones anteriores a 2.7.4, los tokens CSRF pueden ser reusados por un usuario malicioso, ya que en los servidores Windows no se realiza una limpieza de los tokens CSRF. • https://github.com/Combodo/iTop/security/advisories/GHSA-cxw7-2x7h-f7pr • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.7EPSS: 0%CPEs: 4EXPL: 0CVE-2021-32775 – Any user can see any fields (including mailbox password) with GroupBy Dashlet
https://notcve.org/view.php?id=CVE-2021-32775
Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field values through GroupBy Dashlet error message. This issue is fixed in versions 2.7.4 and 3.0.0. Combodo iTop es una herramienta de Administración de Servicios de TI basada en la web. En versiones anteriores a 2.7.4, un usuario no administrador puede acceder a muchos valores de clase/campo mediante el mensaje de error GroupBy Dashlet. • https://github.com/Combodo/iTop/security/advisories/GHSA-xh7w-rrp3-fhpq • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-21406 – Command Injection vulnerability in the Setup Wizard
https://notcve.org/view.php?id=CVE-2021-21406
Combodo iTop is an open source, web based IT Service Management tool. In versions prior to 2.7.4, there is a command injection vulnerability in the Setup Wizard when providing Graphviz executable path. The vulnerability is patched in version 2.7.4 and 3.0.0. Combodo iTop es una herramienta de administración de servicios de TI de código abierto basada en la web. En versiones anteriores a 2.7.4, se presenta una vulnerabilidad de inyección de comandos en el Asistente de Configuración cuando se proporciona la ruta del ejecutable de Graphviz. • https://github.com/Combodo/iTop/security/advisories/GHSA-pf95-6h7q-q85x • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •