Combodo iTop is a simple, web based IT Service Management tool. This vulnerability can be used to create HTTP requests on behalf of the server, from a low privileged user. The user portal form manager has been fixed to only instantiate classes derived from it. This issue has been addressed in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
References
| Link | Resource |
|---|---|
| https://github.com/Combodo/iTop/security/advisories/GHSA-w9g8-mxm5-ph62 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
08 Nov 2024, 21:09
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Combodo
Combodo itop |
|
| CPE | cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| References | () https://github.com/Combodo/iTop/security/advisories/GHSA-w9g8-mxm5-ph62 - Vendor Advisory |
05 Nov 2024, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-05 19:15
Updated : 2024-11-08 21:09
NVD link : CVE-2024-51740
Mitre link : CVE-2024-51740
JSON object : View
Products Affected
combodo
- itop
CWE
CWE-918
Server-Side Request Forgery (SSRF)