Itop

PHP object injection in Combodo iTop's user preference functionality prior to version 3.2.3 enables authenticated remote attackers to achieve remote code execution on the underlying server. The vulnerability stems from deserializing attacker-controlled PHP objects without validation, with the CVSS Scope:Changed metric reflecting that successful exploitation escapes the application boundary to compromise the host. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CWE-502 vulnerability class is well-understood and the attack complexity is rated Low once an authenticated session is obtained.

Reflected XSS in Combodo iTop prior to version 3.2.3 allows an authenticated attacker to inject malicious scripts via the dashboard revert functionality, executing arbitrary JavaScript in a victim's browser session within the iTop context. The CVSS 8.9 score and Changed scope (S:C) reflect that successful exploitation extends impact beyond the iTop application itself - enabling session hijacking, credential theft, or privilege escalation on behalf of the victim user. No public exploit code or CISA KEV listing has been identified at time of analysis.

Unauthenticated code execution in Combodo iTop before 3.2.3 arises because remote users can delete the setup-generated .readonly lockfile, which is the guard that blocks write operations and, once removed, re-opens privileged setup/configuration paths that lead to arbitrary code execution (CWE-94). Any internet-reachable iTop instance below 3.2.3 is affected, and the flaw carries a CVSS 4.0 score of 9.4 with full confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the trivial precondition (a single unauthenticated file-deletion request) makes weaponization realistic.

Unauthenticated deletion of the iTop `.readonly` write-protection file is possible in Combodo iTop prior to version 3.2.3, allowing any remote attacker to remove a critical filesystem-based access control mechanism. The `.readonly` file is created during the setup process specifically to block write operations on the iTop instance; its deletion effectively disables that safeguard without any credentials. No active exploitation has been confirmed (not in CISA KEV), but the low attack complexity and zero authentication requirement make this a straightforward attack against any exposed iTop instance. The issue is fixed in version 3.2.3 per the GitHub security advisory GHSA-2xh3-r27f-3pr5.

Access control bypass in Combodo iTop prior to 3.2.3 allows authenticated low-privileged users to read data outside their assigned silos via crafted OQL queries. The iTop silo isolation mechanism - which restricts users to specific data partitions - fails to apply visibility filters to classes joined in OQL but not explicitly listed in the SELECT clause, enabling cross-silo confidential data disclosure. No public exploit code or CISA KEV listing exists at time of analysis; the vendor has released a confirmed fix in version 3.2.3.

Unauthorized document access in Combodo iTop before version 3.2.3 allows any authenticated user to retrieve documents and attachments belonging to organizations or objects they lack permission to view. The root cause is a logic inversion in the PHP DownloadDocument method: a host-object rights check could silently pass due to incorrect boolean handling, bypassing the intended access control gate entirely. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS PR:L vector confirms exploitation requires only a valid low-privileged account.

Unauthenticated remote PHP file execution in Combodo iTop prior to 3.2.3 allows attackers to invoke arbitrary PHP files from the env-production module directory by sending crafted requests to the exec.php dispatcher, which performed no authentication check before routing to module pages. The flaw is classified as CWE-306 (Missing Authentication for Critical Function) and carries a CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N), indicating zero-friction network exploitation with no credentials required. No public exploit code or CISA KEV listing has been identified at time of analysis.

Sensitive information disclosure in Combodo iTop prior to version 3.2.3 leaks raw exception messages to authenticated users through the application's AJAX rendering layer. In ajax.render.php, caught exceptions were echoed back to the browser via $e->GetMessage() (HTML-escaped to prevent XSS, but not content-filtered), potentially exposing internal file paths, database schema details, stack context, or configuration fragments. No public exploit has been identified at time of analysis, and the low CVSS score of 3.5 reflects limited practical impact; however, the disclosed internals can meaningfully assist further reconnaissance.

Reflected XSS in Combodo iTop's foreign key search criteria API (all versions prior to 3.2.3) enables remote attackers to execute arbitrary JavaScript in the browser context of authenticated iTop users by delivering a crafted URL. The CVSS 8.8 rating reflects low attack complexity and high impact on confidentiality, integrity, and availability within the ITSM platform's session context. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patch 3.2.3 is available.

Object locking in Combodo iTop prior to version 3.2.3 can be triggered by any authenticated user regardless of assigned write permissions, enabling targeted denial-of-service against legitimate editors. The missing authorization check in the lock acquisition endpoint (ajax.render.php) allows low-privilege users to lock objects they have no right to modify, blocking users who do hold write permissions from editing those objects. No active exploitation has been confirmed and no public exploit code exists; vendor-released patch is available in version 3.2.3.

Missing object-level authorization in Combodo iTop prior to 3.2.3 allows authenticated users to retrieve IT management objects outside their permitted access scope via the search interface. The flaw resides in AjaxRenderController::GetDataForTable(), which returned DBObjectSet results without calling UserRights::IsActionAllowed() - confirmed by the fix commit. No public exploit has been identified at time of analysis, but the low-privilege, network-accessible attack path makes this a credible threat for any multi-tenant or role-segmented iTop deployment.

Reflected XSS in Combodo iTop's universal search feature (all versions prior to 3.2.3) allows an authenticated attacker to inject arbitrary JavaScript via the OQL filter parameter, which executes in a victim's browser upon visiting a crafted URL. The root cause is direct HTML output of the user-supplied OQL query string in UniversalSearch.php without sanitization, confirmed by the patch commit adding utils::EscapeHtml(). No CISA KEV listing or confirmed public exploit exists at time of analysis; exploitation requires attacker-supplied credentials and victim interaction, limiting opportunistic risk despite the CVSS 8.0 rating.

Reflected Cross-Site Scripting in Combodo iTop's tagadmin.php page allows an authenticated attacker to craft a malicious URL that, when visited by another authenticated user, executes arbitrary JavaScript in their browser session. All iTop installations prior to version 3.2.3 are affected, with the vulnerability root-caused to the $sFilter request parameter being reflected into HTML output without sanitization. No public exploit or active exploitation has been identified at time of analysis, but the high CVSS impact scores reflect the realistic potential for session hijacking or privilege escalation within the iTop management interface.

Reflected XSS in Combodo iTop's synchro import script prior to version 3.2.3 enables attackers to inject and execute arbitrary JavaScript in the browsers of authenticated users who click a crafted link. The vulnerable parameter `data_source_id` in `synchro/synchro_import.php` was processed without output encoding, as confirmed by the vendor fix commit. No active exploitation has been identified at time of analysis, and no public exploit code has been disclosed.

Reflected XSS in Combodo iTop's dashboard save functionality, present in all releases prior to 3.2.3, allows remote unauthenticated attackers to execute arbitrary JavaScript in the browser of an authenticated iTop user. The vulnerability originates in ajax.render.php, where dashboard_id and reload_url parameters were interpolated directly into inline JavaScript without escaping. With a CVSS Scope Changed classification (S:C), successful exploitation can affect resources beyond the iTop origin. No public exploit code or CISA KEV listing has been identified at time of analysis.

Reflected XSS in Combodo iTop's OQL query testing interface (run_query.php) allows authenticated attackers to inject and execute arbitrary JavaScript in the browser sessions of other authenticated users. All iTop versions prior to 3.2.3 are affected; the vendor has released a patch in 3.2.3 confirmed by a public GitHub advisory and commit. No public exploit code or active exploitation has been identified at time of analysis.

Reflected XSS in Combodo iTop prior to version 3.2.3 allows an authenticated low-privilege attacker to inject arbitrary JavaScript via the unsanitized `dashboard_id` parameter in the dashboard revert endpoint `/pages/ajax.render.php`. When a crafted URL is opened by a higher-privileged victim, the payload executes in their browser context, enabling session hijacking or unauthorized actions performed under the victim's identity. No CISA KEV listing or public proof-of-concept exploit has been identified at time of analysis.

Unauthenticated access to inline images in Combodo iTop prior to version 3.2.3 is protected by a 24-bit secret generated with PHP's non-cryptographic mt_rand(), yielding only ~16.7 million possible values and making brute-force enumeration feasible for any network-reachable attacker. The commit diff confirms the secret was stored as a 6-character hex string (sprintf('%06x', mt_rand(0, 0xFFFFFF))), and a secondary timing side-channel existed because the comparison used != instead of constant-time hash_equals(). No active exploitation is confirmed in CISA KEV, and no public POC has been identified at time of analysis.

Version disclosure in Combodo iTop's login page exposes the complete application version string in the HTML title attribute of the logo element to unauthenticated remote users. All iTop releases prior to 3.2.3 are affected; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication or user interaction against any network-accessible login page. No active exploitation has been confirmed (not in CISA KEV) and no public POC has been identified; this vulnerability primarily enables reconnaissance that can be chained into version-targeted follow-on attacks.

User enumeration in Combodo iTop prior to version 3.2.3 allows remote unauthenticated attackers to identify valid accounts by observing distinct error responses in the forgot-password mechanism. The application returned different messages depending on account state - external authentication, fixed password, missing email - making it possible to distinguish valid usernames from invalid ones without any credentials. No public exploit code has been identified at time of analysis, and the issue is resolved in iTop 3.2.3 per the vendor's GitHub Security Advisory GHSA-888g-gv33-xwwx.

Unauthenticated remote access to uploaded documents is possible in Combodo iTop versions prior to 3.2.3 due to a missing authentication check in the ajax.document.php endpoint. The commit diff confirms that LoginWebPage::DoLoginEx() was absent from critical code paths that serve uploaded files, allowing any network-reachable user who obtains a valid document URL to download sensitive content without credentials. No public exploit code has been identified at time of analysis, but the attack is technically trivial given the low-complexity, unauthenticated CVSS vector.

Combodo iTop is a web based IT service management tool. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Combodo iTop is a web based IT service management tool. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Combodo iTop is a web based IT service management tool. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Combodo iTop is a web based IT service management tool. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Combodo iTop is a web based IT service management tool. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Combodo iTop is a web based IT service management tool. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Combodo iTop is a web based IT service management tool. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Combodo iTop is a web based IT service management tool. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

iTop is an web based IT Service Management tool. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

iTop is an web based IT Service Management tool. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

iTop is an web based IT Service Management tool. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.

iTop is an web based IT Service Management tool. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. No vendor patch available.

iTop is an web based IT Service Management tool. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

iTop is an web based IT Service Management tool. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

iTop is an web based IT Service Management tool. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Combodo iTop is a web based IT service management tool. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Combodo iTop is an open source and web-based IT service management platform. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Combodo iTop is a simple, web based IT Service Management tool. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Combodo iTop is a simple, web based IT Service Management tool. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Combodo iTop is a simple, web based IT Service Management tool. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Combodo iTop is a web based IT Service Management tool. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable. No vendor patch available.

Combodo iTop is a web based IT Service Management tool. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Combodo iTop is a web based IT Service Management tool. Rated low severity (CVSS 3.4), this vulnerability is low attack complexity. No vendor patch available.

Combodo iTop is a simple, web based IT Service Management tool. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Combodo iTop is a simple, web based IT Service Management tool. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Combodo iTop is a simple, web based IT Service Management tool. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Combodo iTop is a simple, web based IT Service Management tool. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Combodo iTop is a simple, web based IT Service Management tool. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CSV injection in export as csv in Combodo iTop v.3.1.0-2-11973 allows a local attacker to execute arbitrary code via a crafted script to the export-v2.php and ajax.render.php components. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

Cross Site Scripting vulnerability in Combodo iTop v.3.1.0-2-11973 allows a local attacker to obtain sensitive information via a crafted script to the attrib_manager_id parameter in the General. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

iTop is an open source, web-based IT service management platform. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

iTop is an open source, web-based IT service management platform. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/pages/ajax.render.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/webservices/export-v2.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Combodo iTop is a web based IT Service Management tool. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Combodi iTop is a web based IT Service Management tool. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Combodo iTop is a web based IT Service Management tool. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Combodo iTop is an open source web based IT Service Management tool. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

iTop is an open source web based IT Service Management tool. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.

Combodo iTop is a web based IT Service Management tool. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Combodo iTop is a web based IT Service Management tool. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Combodo iTop is an open source, web based IT Service Management tool. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Combodo iTop is an open source, web based IT Service Management tool. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A security misconfiguration exists in Combodo iTop, which can expose sensitive information. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary commands by changing the platform configuration, because. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Multiple cross-site scripting (XSS) vulnerabilities in the search feature in iTop (aka IT Operations Portal) 2.0, 1.2.1, 1.2, and earlier allow remote attackers to inject arbitrary web script or HTML. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.