Vulnerability · Published Jul 21, 2021 · Assigned by GitHub_M
CVE-2021-21407Portal : the CSRF token isn't validated
High 8.0
In plain English
A high-severity cross-site request forgery in iTop from Combodo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 3.1)8.0High
Exploit odds (30 days)0.5%top 59.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Combodo iTop is an open source, web based IT Service Management tool. Prior to version 2.7.4, the CSRF token validation can be bypassed through iTop portal via a tricky browser procedure. The vulnerability is patched in version 2.7.4 and 3.0.0.
Affected products (as reported)
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
References
- https://github.com/Combodo/iTop/security/advisories/GHSA-9wq8-4qm9-3j6f x_refsource_CONFIRM