Skip to main content

Combodo iTop CVE-2026-33333

| EUVDEUVD-2026-64182 LOW
Error Message Information Leak (CWE-209)
2026-08-21 GitHub_M
Information Disclosure Itop Combodo
3.5
CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY
3.5 LOW
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
vuln.today AI
4.3 MEDIUM

Authenticated attacker triggers error via crafted AJAX request without victim interaction; PR:L confirmed, UI:N because the attacker acts alone.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 21, 2026 - 22:16 vuln.today
Analysis Generated
Aug 21, 2026 - 22:16 vuln.today
Patch available
Aug 21, 2026 - 22:02 EUVD

DescriptionCVE.org

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the error messages. This issue has been fixed in version 3.2.3.

AnalysisAI

Sensitive information disclosure in Combodo iTop prior to version 3.2.3 leaks raw exception messages to authenticated users through the application's AJAX rendering layer. In ajax.render.php, caught exceptions were echoed back to the browser via $e->GetMessage() (HTML-escaped to prevent XSS, but not content-filtered), potentially exposing internal file paths, database schema details, stack context, or configuration fragments. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid authenticated session with at least low-privilege access to the iTop web interface (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N scores 3.5 (Low), consistent with a post-authentication, limited-scope information disclosure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to Combodo iTop 3.2.3 or later, which is the vendor-released patch resolving this issue. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Itop

View all
CVE-2022-24780 HIGH POC
8.8 Apr 05

Combodo iTop is a web based IT Service Management tool. Rated high severity (CVSS 8.8), this vulnerability is remotely e
CVE-2018-10642 HIGH POC
7.2 May 02

Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary co
CVE-2022-31403 MEDIUM POC
6.1 Jun 14

ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/pages/ajax.render.php. Rated

CVE-2022-31402 MEDIUM POC
6.1 Jun 10

ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/webservices/export-v2.php. Ra
CVE-2024-32870 MEDIUM POC
5.8 Nov 05

Combodo iTop is a simple, web based IT Service Management tool. Rated medium severity (CVSS 5.8), this vulnerability is

CVE-2024-54139 CRITICAL
9.6 Dec 13

Combodo iTop is an open source and web-based IT service management platform. Rated critical severity (CVSS 9.6), this vu
CVE-2026-39975 CRITICAL
9.4 Aug 24

Unauthenticated code execution in Combodo iTop before 3.2.3 arises because remote users can delete the setup-generated .
CVE-2022-24870 MEDIUM POC
5.4 Apr 21

Combodo iTop is a web based IT Service Management tool. Rated medium severity (CVSS 5.4), this vulnerability is remotely
CVE-2022-24811 MEDIUM POC
5.4 Apr 05

Combodi iTop is a web based IT Service Management tool. Rated medium severity (CVSS 5.4), this vulnerability is remotely
CVE-2024-51739 MEDIUM POC
5.3 Nov 05

Combodo iTop is a simple, web based IT Service Management tool. Rated medium severity (CVSS 5.3), this vulnerability is

CVE-2026-30864 HIGH
8.9 Aug 24

Reflected XSS in Combodo iTop prior to version 3.2.3 allows an authenticated attacker to inject malicious scripts via th
CVE-2026-33240 HIGH
8.8 Aug 21

Reflected XSS in Combodo iTop's foreign key search criteria API (all versions prior to 3.2.3) enables remote attackers t

Same weakness CWE-209 – Error Message Information Leak

View all
CVE-2025-47813 MEDIUM POC
4.3
CVE-2017-7551 CRITICAL POC
9.8
CVE-2026-48039 CRITICAL POC
9.1
CVE-2022-31140 CRITICAL POC
9.1
CVE-2024-23689 HIGH POC
8.8
CVE-2018-17961 HIGH POC
8.6
CVE-2023-37306 HIGH POC
7.5
CVE-2026-29146 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-33333 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy