CVE-2021-32663highCWE-918

CVE-2021-32663: high-severity vulnerability in Combodo iTop

Unauthorized setup leads to SSRF in Combodo/iTop

Published · Updated

Follow this CVE+ Monitor iTop

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 1.5%
iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authentication. Given specific parameters this can lead to SSRF. This issue has been resolved in versions 2.6.5 and 2.7.5 and later
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Affected products
Combodo · iTop
Related CVEs — Combodo iTop

In the same product, most dangerous first.

CVE-2022-39214CRITICALAuthenticated users of Combodo iTop can take over any accountEPSS 25.6%CVE-2022-24780HIGHCode Injection in Combodo iTopEPSS 5.7%CVE-2020-12777HIGHCombodo iTop - Broken Access ControlEPSS 1.3%CVE-2024-51739HIGHUsers enumeration allowed through Rest API in Combodo iTopEPSS 1.2%CVE-2020-12780HIGHCombodo iTop - Security MisconfigurationEPSS 1.2%CVE-2021-21406MEDIUMCommand Injection vulnerability in the Setup WizardEPSS 1.0%