Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-24780

Date: April 5, 2022

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.

Language: PHP

Severity Score

Related Resources (9)

https://github.com/Combodo/iTop/commit/b6fac4b411b8d145fc30fa35c66b51243eafd06b
https://github.com/Combodo/iTop/commit/eb2a615bd28100442c7f6171707bb40884af2305
http://packetstormsecurity.com/files/167236/iTop-Remote-Command-Execution.html
https://github.com/Combodo/iTop/security/advisories/GHSA-v97m-wgxq-rh54
https://github.com/Combodo/iTop/commit/93f273a28778e5da8e51096f021d2dc1adbf4ef3
https://markus-krell.de/itop-template-injection-inside-customer-portal/
https://nvd.nist.gov/vuln/detail/CVE-2022-24780
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24780.json
https://www.mend.io/vulnerability-database/CVE-2022-24780

Severity Score

Weakness Type (CWE)

Improper Control of Generation of Code ('Code Injection')

CWE-94

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): SINGLE
Confidentiality (C): PARTIAL
Integrity (I): PARTIAL
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us