Description
iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, server code execution is possible through the frontend of iTop's portal. This is fixed in versions 2.7.12, 3.1.3 and 3.2.1.
References (4)
Core 4
Core References
Vendor Advisory x_refsource_confirm
https://github.com/Combodo/iTop/security/advisories/GHSA-rhv2-wfrr-4j2j
Patch x_refsource_misc
https://github.com/Combodo/iTop/commit/082d865efaf8a349b60fe3875e9c726c24f8a8bd
Patch x_refsource_misc
https://github.com/Combodo/iTop/commit/37fc1a572380f2faa67fddea5b1a3a4ba72ed54e
Patch x_refsource_misc
https://github.com/Combodo/iTop/commit/5780f26817c2303c5bdd0ad16e21d4d959780b0b
Scores
CVSS v3
8.5
EPSS
0.0071
EPSS Percentile
72.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-78
Status
published
Products (1)
combodo/itop
< 2.7.12
Published
May 14, 2025
Tracked Since
Feb 18, 2026