CVE-2022-24780
Code Injection in Combodo iTop
- State
- Published
- Severity
- 8.8 High
- Published
- Apr 5, 2022
- Updated
- Apr 22, 2025
- Reserved
- Feb 10, 2022
Description
Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | GitHub_M |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
iTopCombodo |
|
References
- https://github.com/Combodo/iTop/security/advisories/GHSA-v97m-wgxq-rh54
- https://github.com/Combodo/iTop/commit/93f273a28778e5da8e51096f021d2dc1adbf4ef3
- https://github.com/Combodo/iTop/commit/b6fac4b411b8d145fc30fa35c66b51243eafd06b
- https://github.com/Combodo/iTop/commit/eb2a615bd28100442c7f6171707bb40884af2305
- https://markus-krell.de/itop-template-injection-inside-customer-portal/
- http://packetstormsecurity.com/files/167236/iTop-Remote-Command-Execution.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.