CVE-2025-24021

iTop doesn't have mass assignment of fields in the portal form

CVSS 5 MEDIUMEPSS 0.2%CWE-862

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to object fields when they're not supposed to. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Affected products

Combodo · iTop

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/Combodo/iTop/commit/44290db312901fc5918cc537c74561487fb3713b https://github.com/Combodo/iTop/security/advisories/GHSA-c8hm-h9gv-8jpj