CVE-2024-51739highCWE-200

CVE-2024-51739: fallo de gravedad alta en Combodo iTop

Users enumeration allowed through Rest API in Combodo iTop

Publicada el

Seguir esta CVE+ Monitorear iTop

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

36Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 7.5epss 1.2%
Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a valid account. As a fix the sentence displayed after resetting password no longer shows if the user exists or not. This fix is included in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. Users unable to upgrade may overload the dictionary entry `"UI:ResetPwd-Error-WrongLogin"` through an extension and replace it with a generic message.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
Combodo · iTop
CVEs relacionadas — Combodo iTop

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-39214CRITICALAuthenticated users of Combodo iTop can take over any accountEPSS 25.6%CVE-2022-24780HIGHCode Injection in Combodo iTopEPSS 5.7%CVE-2021-32663HIGHUnauthorized setup leads to SSRF in Combodo/iTopEPSS 1.5%CVE-2020-12777HIGHCombodo iTop - Broken Access ControlEPSS 1.3%CVE-2020-12780HIGHCombodo iTop - Security MisconfigurationEPSS 1.2%CVE-2021-21406MEDIUMCommand Injection vulnerability in the Setup WizardEPSS 1.0%