Combodo iTop (aka IT Operations Portal) 3.0.0 Beta 2
Approved changes feed: RSS · Atom
cpe:2.3:a:combodo:itop:3.0.0:beta2:*:*:*:*:*:*
part: a version: 3.0.0 update: beta2
| Vendor | Combodo (5f617ad5-36d7-51e9-bc58-49b4ffac8ff9) |
|---|---|
| Product | Itop (03085436-c0ca-5a03-a488-0c01f37a9ca5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/combodo/itop |
purl2cpe | 2026-06-01 10:17:55.036264 |
pkg:sourceforge/itop |
purl2cpe | 2026-06-01 10:17:55.036265 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-24870 |
vulnerable | 2026-06-08 05:41:44.800556 |
Stored Cross-site Scripting in Combodo iTop
HIGH (8.7)
Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to 3.0.0 beta3 a malicious script can be injected in tooltips using iTop customization mechanism. This provides a stored cross site scripting attack vector to authorized users of the system. Users are advised to upgrade. There are no known workarounds for this issue.
Published: 2022-04-21T16:40:12.000Z
Updated: 2025-04-22T18:14:28.943Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24780 |
vulnerable | 2026-06-08 05:41:01.616258 |
Code Injection in Combodo iTop
HIGH (8.8)
Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.
Published: 2022-04-05T18:30:18.000Z
Updated: 2025-04-22T18:17:20.019Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-41162 |
vulnerable | 2026-06-08 05:35:19.857314 |
Cross-site Scripting in Combodo iTop
CRITICAL (9.3)
Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to beta6 the `ajax.render.php?operation=wizard_helper` page did not properly escape the user supplied parameters, allowing for a cross site scripting attack vector. Users are advised to upgrade. There are no known workarounds for this issue.
Published: 2022-04-21T16:45:13.000Z
Updated: 2025-04-23T18:33:13.674Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-41161 |
vulnerable | 2026-06-08 05:35:19.853398 |
XSS in csvimport in 3.0.0-beta versions
CRITICAL (9.3)
Combodo iTop is a web based IT Service Management tool. In versions prior to 3.0.0-beta6 the export CSV page don't properly escape the user supplied parameters, allowing for javascript injection into rendered csv files. Users are advised to upgrade. There are no known workarounds for this issue.
Published: 2022-04-21T16:35:10.000Z
Updated: 2025-04-23T18:33:19.728Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-32776 |
vulnerable | 2026-06-08 05:32:08.018132 |
No CSRF form token cleanup on Windows servers
MEDIUM (6.8)
Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Windows servers no cleanup is done on CSRF tokens. This issue is fixed in versions 2.7.4 and 3.0.0.
Published: 2021-07-21T20:25:09.000Z
Updated: 2024-08-03T23:33:55.825Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-32775 |
vulnerable | 2026-06-08 05:32:08.017632 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-12781 |
vulnerable | 2026-06-08 05:17:59.130637 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-12778 |
vulnerable | 2026-06-08 05:17:59.125265 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-12777 |
vulnerable | 2026-06-08 05:17:59.118727 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.