CVE-2021-32663

iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authentication. Given specific parameters this can lead to SSRF. This issue has been resolved in versions 2.6.5 and 2.7.5 and later
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:combodo:itop:*:*:*:*:-:*:*:*
cpe:2.3:a:combodo:itop:*:*:*:*:-:*:*:*

History

22 Oct 2021, 20:49

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 8.7
v2 : 5.0
v3 : 7.5
CPE cpe:2.3:a:combodo:itop:*:*:*:*:-:*:*:*
References (MISC) https://github.com/Combodo/iTop/commit/6be9a87c150978752bc68baae1a5c4833ddadfec - (MISC) https://github.com/Combodo/iTop/commit/6be9a87c150978752bc68baae1a5c4833ddadfec - Patch, Third Party Advisory
References (CONFIRM) https://github.com/Combodo/iTop/security/advisories/GHSA-ghqc-r8f6-q9m9 - (CONFIRM) https://github.com/Combodo/iTop/security/advisories/GHSA-ghqc-r8f6-q9m9 - Third Party Advisory
References (MISC) https://github.com/Combodo/iTop/commit/43daa2ef088bf928a2386fa19324628c3f19b807 - (MISC) https://github.com/Combodo/iTop/commit/43daa2ef088bf928a2386fa19324628c3f19b807 - Patch, Third Party Advisory

19 Oct 2021, 18:16

Type Values Removed Values Added
New CVE

Information

Published : 2021-10-19 18:15

Updated : 2024-02-04 22:08


NVD link : CVE-2021-32663

Mitre link : CVE-2021-32663

CVE.ORG link : CVE-2021-32663


JSON object : View

Products Affected

combodo

  • itop
CWE
CWE-918

Server-Side Request Forgery (SSRF)