Combodo Itop vulnerabilities

CVE-2024-32870 [MEDIUM] CWE-200 CVE-2024-32870: Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info (name, version and parameters) can be read by anyone having access to iTop URI. This issue has been patched in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE-2011-4275 [MEDIUM] CWE-79 CVE-2011-4275: Multiple cross-site scripting (XSS) vulnerabilities in iTop (aka IT Operations Portal) 1.1.181 and 1 Multiple cross-site scripting (XSS) vulnerabilities in iTop (aka IT Operations Portal) 1.1.181 and 1.2.0-RC-282 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted company name, (2) a crafted database server name, (3) a crafted CSV file, (4) a crafted copy-and-paste action, (5) the auth_user parameter in a suggest_pwd action

CVE-2026-34741 [HIGH] CWE-306 CVE-2026-34741: Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3.

CVE-2022-24780 [HIGH] CWE-94 CVE-2022-24780: Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workaround

CVE-2022-39214 [HIGH] CWE-863 CVE-2022-39214: Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 an Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, a user who can log in on iTop is able to take over any account just by knowing the account's username. This issue is fixed in versions 2.7.8 and 3.0.2-1.

CVE-2015-6544 [MEDIUM] CWE-79 CVE-2015-6544: Cross-site scripting (XSS) vulnerability in application/dashboard.class.inc.php in Combodo iTop befo Cross-site scripting (XSS) vulnerability in application/dashboard.class.inc.php in Combodo iTop before 2.2.0-2459 allows remote attackers to inject arbitrary web script or HTML via a dashboard title.

CVE-2025-24022 [HIGH] CWE-78 CVE-2025-24022: iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, server iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, server code execution is possible through the frontend of iTop's portal. This is fixed in versions 2.7.12, 3.1.3 and 3.2.1.

CVE-2024-51739 [MEDIUM] CWE-200 CVE-2024-51739: Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform use Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a valid account. As a fix the sentence displayed after resetting password no longer shows if the user exists or not. This fix is included in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are adv

CVE-2026-39975 [CRITICAL] CWE-94 CVE-2026-39975: Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actions. This issue has been fixed in version 3.2.3.

CVE-2021-21406 [HIGH] CWE-77 CVE-2021-21406: Combodo iTop is an open source, web based IT Service Management tool. In versions prior to 2.7.4, th Combodo iTop is an open source, web based IT Service Management tool. In versions prior to 2.7.4, there is a command injection vulnerability in the Setup Wizard when providing Graphviz executable path. The vulnerability is patched in version 2.7.4 and 3.0.0.

CVE-2026-40877 [HIGH] CWE-94 CVE-2026-40877: Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP ob Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3.

CVE-2024-51740 [HIGH] CWE-918 CVE-2024-51740: Combodo iTop is a simple, web based IT Service Management tool. This vulnerability can be used to cr Combodo iTop is a simple, web based IT Service Management tool. This vulnerability can be used to create HTTP requests on behalf of the server, from a low privileged user. The user portal form manager has been fixed to only instantiate classes derived from it. This issue has been addressed in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised

CVE-2022-39216 [CRITICAL] CWE-330 CVE-2022-39216: Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 an Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, the reset password token is generated without any randomness parameter. This may lead to account takeover. The issue is fixed in versions 2.7.8 and 3.0.2-1.

CVE-2026-31936 [HIGH] CWE-862 CVE-2026-31936: Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthor Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object information through the search operation. This issue has been fixed in version 3.2.3.

CVE-2018-10642 [HIGH] CWE-94 CVE-2018-10642: Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary commands by changing the platform configuration, because web/env-production/itop-config/config.php contains a function called TestConfig() that calls the vulnerable function eval().

CVE-2023-48710 [CRITICAL] CWE-552 CVE-2023-48710: iTop is an IT service management platform. Files from the `env-production` folder can be retrieved iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted access. Hopefully, there is no sensitive files stored in that folder natively, but there could be from a third-party module. The `pages/exec.php` script as been fixed to limit execution of PHP files only. Other f

CVE-2019-19821 [HIGH] CWE-79 CVE-2019-19821: A post-authentication privilege escalation in the web application of Combodo iTop allows regular aut A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify information with administrative privileges by not following the HTTP Location header in server responses. This is fixed in all iTop packages (community, essential, professional) in versions : 2.5.4, 2.6.3

CVE-2021-32663 [HIGH] CWE-918 CVE-2021-32663: iTop is an open source web based IT Service Management tool. In affected versions an attacker can ca iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authentication. Given specific parameters this can lead to SSRF. This issue has been resolved in versions 2.6.5 and 2.7.5 and later

CVE-2025-47286 [HIGH] CWE-74 CVE-2025-47286: Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, an ad Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, an administrator can, by editing the configuration of the iTop instance, execute code on the server. Versions 2.7.13 and 3.2.2 escape and check the config parameter before executing a command based on it.

CVE-2026-34948 [HIGH] CWE-200 CVE-2026-34948: Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3.