Combodo Itop vulnerabilities

CVE-2020-12780 [HIGH] CWE-863 CVE-2020-12780: A security misconfiguration exists in Combodo iTop, which can expose sensitive information. A security misconfiguration exists in Combodo iTop, which can expose sensitive information.

CVE-2026-34949 [MEDIUM] CWE-306 CVE-2026-34949: Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3.

CVE-2024-52601 [MEDIUM] CWE-639 CVE-2024-52601: iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access to objects they're not allowed to see by querying an unprotected route. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.

CVE-2021-41245 [HIGH] CWE-352 CVE-2021-41245: Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, CSRF t Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, CSRF tokens generated by `privUITransactionFile` aren't properly checked. Versions 2.7.6 and 3.0.0 contain a patch for this issue. As a workaround, use the session implementation by adding in the iTop config file.

CVE-2026-30890 [HIGH] CWE-79 CVE-2026-30890: Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script. This issue has been fixed in version 3.2.3.

CVE-2025-49145 [MEDIUM] CWE-863 CVE-2025-49145: Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a use Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks (mostly administrators) can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature.

CVE-2020-12781 [HIGH] CWE-352 CVE-2020-12781: Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute speci Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery.

CVE-2019-13967 [HIGH] CVE-2019-13967: iTop 2.2.0 through 2.6.0 allows remote attackers to cause a denial of service (application outage) v iTop 2.2.0 through 2.6.0 allows remote attackers to cause a denial of service (application outage) via many requests to launch a compile operation. The requests use the pages/exec.php?exec_env=production&exec_module=itop-hub-connector&exec_page=ajax.php&operation=compile URI. This only affects the community version.

CVE-2021-32775 [MEDIUM] CWE-209 CVE-2021-32775: Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field values through GroupBy Dashlet error message. This issue is fixed in versions 2.7.4 and 3.0.0.

CVE-2020-15218 [MEDIUM] CWE-613 CVE-2020-15218: Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, adm Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, admin pages are cached, so that their content is visible after deconnection by using the browser back button. This is fixed in versions 2.7.2 and 3.0.0.

CVE-2021-21407 [MEDIUM] CWE-352 CVE-2021-21407: Combodo iTop is an open source, web based IT Service Management tool. Prior to version 2.7.4, the CS Combodo iTop is an open source, web based IT Service Management tool. Prior to version 2.7.4, the CSRF token validation can be bypassed through iTop portal via a tricky browser procedure. The vulnerability is patched in version 2.7.4 and 3.0.0.

CVE-2024-56157 [MEDIUM] CWE-79 CVE-2024-56157: iTop is an web based IT Service Management tool. Prior to versions 3.1.3 and 3.2.1, by filling malic iTop is an web based IT Service Management tool. Prior to versions 3.1.3 and 3.2.1, by filling malicious code in a CSV content, a cross-site scripting attack can be performed when importing this content. The issue is fixed in versions 3.1.3 and 3.2.1. As a workaround, check CSV content before importing it.

CVE-2026-30865 [HIGH] CWE-79 CVE-2026-30865: Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3.

CVE-2026-27463 [MEDIUM] CWE-200 CVE-2026-27463: Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3.

CVE-2019-13965 [MEDIUM] CVE-2019-13965: Because of a lack of sanitization around error messages, multiple Reflective XSS issues exist in iTo Because of a lack of sanitization around error messages, multiple Reflective XSS issues exist in iTop through 2.6.0 via the param_file parameter to webservices/export.php, webservices/cron.php, or env-production/itop-backup/backup.php. By default, any XSS sent to the administrator can be transformed to remote command execution because of CVE-2018-10642 (sti

CVE-2025-64167 [MEDIUM] CWE-79 CVE-2025-64167: Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulne Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-site scripting attack (leading to JS execution) when editing the URL parameter. Versions 2.7.13 and 3.2.2 don't use export.php, which was deprecated. They use export-v2.php instead.

CVE-2025-47932 [MEDIUM] CWE-79 CVE-2025-47932: Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulne Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a dashboard is rendered via an AJAX call. Versions 2.7.13 and 3.2.2 sanitize the var responsible for the attack.

CVE-2025-24026 [MEDIUM] CWE-1333 CVE-2025-24026: iTop is an web based IT Service Management tool. Versions prior to 3.2.1 are vulnerable to regular e iTop is an web based IT Service Management tool. Versions prior to 3.2.1 are vulnerable to regular expression denial of service (ReDoS) that may, under some circumstances, affect iTop server. Version 3.2.1 doesn't use the affected variable in the regular expression. As a workaround, if iTop app_root_url is defined in the configuration file, then th

CVE-2025-24021 [MEDIUM] CWE-862 CVE-2025-24021: iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to object fields when they're not supposed to. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.

CVE-2023-34446 [MEDIUM] CWE-79 CVE-2023-34446: iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, when displaying `pages/preferences.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0.