Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.
References
Link | Resource |
---|---|
http://packetstormsecurity.com/files/167236/iTop-Remote-Command-Execution.html | Exploit Third Party Advisory VDB Entry |
https://github.com/Combodo/iTop/commit/93f273a28778e5da8e51096f021d2dc1adbf4ef3 | Patch Third Party Advisory |
https://github.com/Combodo/iTop/commit/b6fac4b411b8d145fc30fa35c66b51243eafd06b | Patch Third Party Advisory |
https://github.com/Combodo/iTop/commit/eb2a615bd28100442c7f6171707bb40884af2305 | Patch Third Party Advisory |
https://github.com/Combodo/iTop/security/advisories/GHSA-v97m-wgxq-rh54 | Third Party Advisory |
https://markus-krell.de/itop-template-injection-inside-customer-portal/ | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
23 May 2022, 16:16
Type | Values Removed | Values Added |
---|---|---|
References |
|
19 Apr 2022, 15:22
Type | Values Removed | Values Added |
---|---|---|
References | (CONFIRM) https://github.com/Combodo/iTop/security/advisories/GHSA-v97m-wgxq-rh54 - Third Party Advisory | |
References | (MISC) https://markus-krell.de/itop-template-injection-inside-customer-portal/ - Exploit, Third Party Advisory | |
References | (MISC) https://github.com/Combodo/iTop/commit/b6fac4b411b8d145fc30fa35c66b51243eafd06b - Patch, Third Party Advisory | |
References | (MISC) https://github.com/Combodo/iTop/commit/eb2a615bd28100442c7f6171707bb40884af2305 - Patch, Third Party Advisory | |
References | (MISC) https://github.com/Combodo/iTop/commit/93f273a28778e5da8e51096f021d2dc1adbf4ef3 - Patch, Third Party Advisory | |
CVSS |
v2 : v3 : |
v2 : 6.5
v3 : 8.8 |
CPE | cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:* |
05 Apr 2022, 19:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-04-05 19:15
Updated : 2024-02-04 22:29
NVD link : CVE-2022-24780
Mitre link : CVE-2022-24780
CVE.ORG link : CVE-2022-24780
JSON object : View
Products Affected
combodo
- itop
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')