Vulnerability · Published Jul 21, 2021 · Assigned by GitHub_M

CVE-2021-21406Command Injection vulnerability in the Setup Wizard

Medium 5.8

In plain English

A medium-severity command injection in iTop from Combodo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).

Severity (CVSS 3.1)5.8Medium

Exploit odds (30 days)1.0%top 36.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Combodo iTop is an open source, web based IT Service Management tool. In versions prior to 2.7.4, there is a command injection vulnerability in the Setup Wizard when providing Graphviz executable path. The vulnerability is patched in version 2.7.4 and 3.0.0.

Affected products (as reported)

Vendor	Product	Versions
Combodo	iTop	< 2.7.4

Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N

References

https://github.com/Combodo/iTop/security/advisories/GHSA-pf95-6h7q-q85x x_refsource_CONFIRM