CVE-2024-51993

Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for misconfigured Users. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. Users unable to upgrade are advised to encrypt their...

CVE-2024-51993

CVE-2024-51993 affects Combodo iTop (pre-3.2.0) where passwords for misconfigured users are stored in cleartext and can be read if an attacker gains access to backups or the database. The issue is mitigated by upgrading to version 3.2.0 or later. If upgrading is not possible, encryption of backup...

CVE-2024-51993

Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for misconfigured Users. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. Users unable to upgrade are advised to encrypt their...

CVE-2024-51993 Password is stored in clear in the database in Combodo iTop

Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for misconfigured Users. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. Users unable to upgrade are advised to encrypt their...

CVE-2024-51993 Password is stored in clear in the database in Combodo iTop

Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for misconfigured Users. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. Users unable to upgrade are advised to encrypt their...

CVE-2024-51993 Password is stored in clear in the database in Combodo iTop

Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for misconfigured Users. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. Users unable to upgrade are advised to encrypt their...

CVE-2024-51994 Cross-site Scripting in portal picture upload in Combodo iTop

Combodo iTop is a web based IT Service Management tool. In affected versions uploading a text file containing some java script in the portal will trigger an Cross-site Scripting XSS vulnerability. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no...

CVE-2024-51994 Cross-site Scripting in portal picture upload in Combodo iTop

Combodo iTop is a web based IT Service Management tool. In affected versions uploading a text file containing some java script in the portal will trigger an Cross-site Scripting XSS vulnerability. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no...

CVE-2024-51994 Cross-site Scripting in portal picture upload in Combodo iTop

Combodo iTop is a web based IT Service Management tool. In affected versions uploading a text file containing some java script in the portal will trigger an Cross-site Scripting XSS vulnerability. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no...

CVE-2024-51994

Affected software: Combodo iTop (web-based IT Service Management). Vulnerability: Cross-site Scripting (XSS) triggered by uploading a text file containing JavaScript in the portal. Root cause / details: The issue exists in versions prior to 3.2.0; uploading a crafted text file enables script exec...

CVE-2024-51995 Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTop

Combodo iTop is a web based IT Service Management tool. An attacker can request any route we want as long as we specify an operation that is allowed. This issue has been addressed in version 3.2.0 by applying the same access control pattern as in UI.php to the ajax.render.php page which does not...

CVE-2024-51995 Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTop

Combodo iTop is a web based IT Service Management tool. An attacker can request any route we want as long as we specify an operation that is allowed. This issue has been addressed in version 3.2.0 by applying the same access control pattern as in UI.php to the ajax.render.php page which does not...

CVE-2024-51995

Combodo iTop is a web based IT Service Management tool. An attacker can request any "route" we want as long as we specify an "operation" that is allowed. This issue has been addressed in version 3.2.0 by applying the same access control pattern as in "UI.php" to the "ajax.render.php" page which...

CVE-2024-51995

Combodo iTop is affected by a logic bug in ajax.render.php that allows bypassing backOffice access control by crafting arbitrary routes, unless an allowed operation is specified. The issue is resolved in version 3.2.0 by applying the same access-control pattern used in UI.php to ajax.render.php, ...

CVE-2024-51995 Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTop

Combodo iTop is a web based IT Service Management tool. An attacker can request any route we want as long as we specify an operation that is allowed. This issue has been addressed in version 3.2.0 by applying the same access control pattern as in UI.php to the ajax.render.php page which does not...

PT-2024-35083 · Comodo · Itop

Name of the Vulnerable Software and Affected Versions: Combodo iTop versions prior to 3.2.0 Description: The issue is related to a Cross-site Scripting XSS vulnerability that can be triggered by uploading a text file containing JavaScript to the portal. This is a web-based IT Service Management...

CVE-2024-51994: Improper Neutralization of Input During Web Page Generation

Combodo iTop is a web based IT Service Management tool. In affected versions uploading a text file containing some java script in the portal will trigger an Cross-site Scripting XSS vulnerability. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no...

Combodo iTop 跨站脚本漏洞

Combodo iTop is a set of open source web applications developed by Combodo France based on ITIL and used for the daily operation of IT environments. The program provides incident management, configuration management, and problem management. A cross-site scripting vulnerability exists in Combodo...

PT-2024-35084

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 3.2.0 Description Combodo iTop is a web-based IT Service Management tool. An issue allows an attacker to request any route as long as they specify an operation that is allowed. The estimated number of potentially...

CVE-2024-51995: Improper Access Control

Combodo iTop is a web based IT Service Management tool. An attacker can request any route we want as long as we specify an operation that is allowed. This issue has been addressed in version 3.2.0 by applying the same access control pattern as in UI.php to the ajax.render.php page which does not...