GCVE - cpe:2.3:a:combodo:itop:3.0.0:rc:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:combodo:itop:3.0.0:rc:*:*:*:*:*:*

part: a version: 3.0.0 update: rc

Vendor	Combodo (`5f617ad5-36d7-51e9-bc58-49b4ffac8ff9`)
Product	Itop (`03085436-c0ca-5a03-a488-0c01f37a9ca5`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/combodo/itop`	purl2cpe	2026-06-01 10:17:55.036283
`pkg:sourceforge/itop`	purl2cpe	2026-06-01 10:17:55.036284

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-24780`	vulnerable	2026-06-08 05:41:01.620412	Code Injection in Combodo iTop HIGH (8.8) Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds. Published: 2022-04-05T18:30:18.000Z Updated: 2025-04-22T18:17:20.019Z Open on db.gcve.eu Reference links https://github.com/Combodo/iTop/security/advisories/GHSA-v97m-wgxq-rh54 https://github.com/Combodo/iTop/commit/93f273a28778e5da8e51096f021d2dc1adbf4ef3 https://github.com/Combodo/iTop/commit/b6fac4b411b8d145fc30fa35c66b51243eafd06b https://github.com/Combodo/iTop/commit/eb2a615bd28100442c7f6171707bb40884af2305 https://markus-krell.de/itop-template-injection-inside-customer-portal/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-12781`	vulnerable	2026-06-08 05:17:59.130940	Combodo iTop - CSRF MEDIUM (5.7) Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery. Published: 2020-08-10T02:45:39.815Z Updated: 2024-09-16T23:26:00.002Z Open on db.gcve.eu Reference links https://www.twcert.org.tw/tw/cp-132-3837-050db-1.html https://github.com/Combodo/iTop/security/advisories/GHSA-34rq-vfmf-gg5v	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-12778`	vulnerable	2026-06-08 05:17:59.125429	Combodo iTop - Reflected XSS HIGH (7.4) Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack. Published: 2020-08-10T02:45:38.492Z Updated: 2024-09-17T01:26:51.771Z Open on db.gcve.eu Reference links https://www.twcert.org.tw/tw/cp-132-3834-591e2-1.html https://github.com/Combodo/iTop/security/advisories/GHSA-8vpf-8vjh-5fcv	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-12777`	vulnerable	2026-06-08 05:17:59.124424	Combodo iTop - Broken Access Control HIGH (7.5) A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information. Published: 2020-08-10T02:45:38.090Z Updated: 2024-09-17T03:22:24.335Z Open on db.gcve.eu Reference links https://www.twcert.org.tw/tw/cp-132-3833-46ae7-1.html https://github.com/Combodo/iTop/security/advisories/GHSA-88fq-r22m-64q2	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.