Combodo Itop vulnerabilities

CVE-2020-12778 [MEDIUM] CWE-79 CVE-2020-12778: Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and laun Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack.

CVE-2023-34443 [MEDIUM] CWE-79 CVE-2023-34443: Combodo iTop is a simple, web based IT Service Management tool. When displaying page Run queries Cro Combodo iTop is a simple, web based IT Service Management tool. When displaying page Run queries Cross-site Scripting (XSS) are possible for scripts outside of script tags. This has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE-2023-34444 [MEDIUM] CWE-79 CVE-2023-34444: Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.searchfor Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.searchform.php XSS are possible for scripts outside of script tags. This issue has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE-2023-34445 [MEDIUM] CWE-79 CVE-2023-34445: Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.render.ph Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.render.php XSS are possible for scripts outside of script tags. This issue has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE-2022-24811 [MEDIUM] CWE-79 CVE-2022-24811: Combodi iTop is a web based IT Service Management tool. Prior to versions 2.7.6 and 3.0.0, cross-sit Combodi iTop is a web based IT Service Management tool. Prior to versions 2.7.6 and 3.0.0, cross-site scripting is possible for scripts outside of script tags when displaying HTML attachments. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.

CVE-2020-15221 [MEDIUM] CWE-79 CVE-2020-15221: Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, by Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, by modifying target browser local storage, an XSS can be generated in the iTop console breadcrumb. This is fixed in versions 2.7.2 and 3.0.0.

CVE-2023-47123 [MEDIUM] CWE-79 CVE-2023-47123: iTop is an IT service management platform. By filling malicious code in an object friendlyname / co iTop is an IT service management platform. By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this object will displayed as an n:n relation item in another object. This vulnerability is fixed in 3.1.1 and 3.2.0.

CVE-2025-27139 [MEDIUM] CWE-79 CVE-2025-27139: Combodo iTop is a web based IT service management tool. Versions prior to 2.7.12, 3.1.2, and 3.2.0 a Combodo iTop is a web based IT service management tool. Versions prior to 2.7.12, 3.1.2, and 3.2.0 are vulnerable to cross-site scripting when the preferences page is opened. Versions 2.7.12, 3.1.2, and 3.2.0 fix the issue.

CVE-2025-24969 [MEDIUM] CWE-639 CVE-2025-24969: iTop is an web based IT Service Management tool. Prior to version 3.2.1, a portal user can see any o iTop is an web based IT Service Management tool. Prior to version 3.2.1, a portal user can see any other contacts picture by changing the picture ID in the URL. Version 3.2.1 contains a patch for the issue.

CVE-2019-13966 [MEDIUM] CVE-2019-13966: In iTop through 2.6.0, an XSS payload can be delivered in certain fields (such as icon) of the XML f In iTop through 2.6.0, an XSS payload can be delivered in certain fields (such as icon) of the XML file used to build the dashboard. This is similar to CVE-2015-6544 (which is only about the dashboard title).

CVE-2020-11696 [MEDIUM] CWE-79 CVE-2020-11696: In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in al In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community, essential, professional) in version 2.7.0 and iTop essential and iTop professional in version 2.6.4.

CVE-2020-11697 [MEDIUM] CWE-79 CVE-2020-11697: In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4.

CVE-2020-12779 [MEDIUM] CWE-79 CVE-2020-12779: Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploadin Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script.

CVE-2025-48878 [MEDIUM] CWE-862 CVE-2025-48878: Combodo iTop is a web based IT service management tool. In versions on the 3.x branch prior to 3.2.2 Combodo iTop is a web based IT service management tool. In versions on the 3.x branch prior to 3.2.2, an insecure direct object reference allows a user (e.g. with Service desk agent profile) to create a ModuleInstallation object when they shouldn't be able to do so. Version 3.2.2 fixes the issue.

CVE-2021-32664 [MEDIUM] CWE-79 CVE-2021-32664: Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5.

CVE-2023-38511 [MEDIUM] CWE-22 CVE-2023-38511: iTop is an IT service management platform. Dashboard editor : can load multiple files and URL, and iTop is an IT service management platform. Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnerability is fixed in 3.0.4 and 3.1.1.

CVE-2020-15219 [MEDIUM] CWE-209 CVE-2020-15219: Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, whe Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, when a download error is triggered in the user portal, an SQL query is displayed to the user. This is fixed in versions 2.7.2 and 3.0.0.

CVE-2024-52001 [MEDIUM] CWE-200 CVE-2024-52001: Combodo iTop is a simple, web based IT Service Management tool. In affected versions portal users ar Combodo iTop is a simple, web based IT Service Management tool. In affected versions portal users are able to access forbidden services information. This issue has been addressed in version 3.2.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE-2025-24785 [MEDIUM] CWE-20 CVE-2025-24785: iTop is an web based IT Service Management tool. In version 3.2.0, an attacker may send a URL to the iTop is an web based IT Service Management tool. In version 3.2.0, an attacker may send a URL to the server to trigger a PHP error. The next user trying to load this dashboard would encounter a crashed start page. Version 3.2.1 fixes the issue by checking the provided layout_class before saving the dashboard.

CVE-2013-0805 [MEDIUM] CWE-79 CVE-2013-0805: Multiple cross-site scripting (XSS) vulnerabilities in the search feature in iTop (aka IT Operations Multiple cross-site scripting (XSS) vulnerabilities in the search feature in iTop (aka IT Operations Portal) 2.0, 1.2.1, 1.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to pages/UI.php or (2) expression parameter to pages/run_query.php. NOTE: some of these details are obtained from third party i