GCVE - cpe:2.3:a:combodo:itop:3.0.0:alpha:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:combodo:itop:3.0.0:alpha:*:*:*:*:*:*

part: a version: 3.0.0 update: alpha

Vendor	Combodo (`5f617ad5-36d7-51e9-bc58-49b4ffac8ff9`)
Product	Itop (`03085436-c0ca-5a03-a488-0c01f37a9ca5`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/combodo/itop`	purl2cpe	2026-06-01 10:17:55.036256
`pkg:sourceforge/itop`	purl2cpe	2026-06-01 10:17:55.036257

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-24780`	vulnerable	2026-06-08 05:41:01.614177	Code Injection in Combodo iTop HIGH (8.8) Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds. Published: 2022-04-05T18:30:18.000Z Updated: 2025-04-22T18:17:20.019Z Open on db.gcve.eu Reference links https://github.com/Combodo/iTop/security/advisories/GHSA-v97m-wgxq-rh54 https://github.com/Combodo/iTop/commit/93f273a28778e5da8e51096f021d2dc1adbf4ef3 https://github.com/Combodo/iTop/commit/b6fac4b411b8d145fc30fa35c66b51243eafd06b https://github.com/Combodo/iTop/commit/eb2a615bd28100442c7f6171707bb40884af2305 https://markus-krell.de/itop-template-injection-inside-customer-portal/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-32776`	vulnerable	2026-06-08 05:32:08.018088	No CSRF form token cleanup on Windows servers MEDIUM (6.8) Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Windows servers no cleanup is done on CSRF tokens. This issue is fixed in versions 2.7.4 and 3.0.0. Published: 2021-07-21T20:25:09.000Z Updated: 2024-08-03T23:33:55.825Z Open on db.gcve.eu Reference links https://github.com/Combodo/iTop/security/advisories/GHSA-cxw7-2x7h-f7pr	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-32775`	vulnerable	2026-06-08 05:32:08.016110	Any user can see any fields (including mailbox password) with GroupBy Dashlet HIGH (7.7) Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field values through GroupBy Dashlet error message. This issue is fixed in versions 2.7.4 and 3.0.0. Published: 2021-07-21T20:20:09.000Z Updated: 2024-08-03T23:33:56.079Z Open on db.gcve.eu Reference links https://github.com/Combodo/iTop/security/advisories/GHSA-xh7w-rrp3-fhpq	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-15221`	vulnerable	2026-06-08 05:19:25.534613	XSS in the breadcrumbs MEDIUM (6.8) Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, by modifying target browser local storage, an XSS can be generated in the iTop console breadcrumb. This is fixed in versions 2.7.2 and 3.0.0. Published: 2021-01-13T17:10:15.000Z Updated: 2024-08-04T13:08:23.137Z Open on db.gcve.eu Reference links https://github.com/Combodo/iTop/security/advisories/GHSA-w6g2-p7pf-7hvw	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-15220`	vulnerable	2026-06-08 05:19:25.534282	Session fixation MEDIUM (6.1) Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, two cookies are created for the same session, which leads to a possibility to steal user session. This is fixed in versions 2.7.2 and 3.0.0. Published: 2021-01-13T17:05:17.000Z Updated: 2024-08-04T13:08:22.815Z Open on db.gcve.eu Reference links https://github.com/Combodo/iTop/security/advisories/GHSA-qw4q-cmcv-7vv2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-15219`	vulnerable	2026-06-08 05:19:25.533909	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-15218`	vulnerable	2026-06-08 05:19:25.533310	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-12781`	vulnerable	2026-06-08 05:17:59.130553	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-12778`	vulnerable	2026-06-08 05:17:59.125080	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-12777`	vulnerable	2026-06-08 05:17:59.114336	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.