Vulnerability · Published Oct 19, 2021 · Assigned by GitHub_M

CVE-2021-32663Unauthorized setup leads to SSRF in Combodo/iTop

High 8.7

In plain English

A high-severity server-side request forgery in iTop from Combodo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).

Severity (CVSS 3.1)8.7High

Exploit odds (30 days)1.5%top 26.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authentication. Given specific parameters this can lead to SSRF. This issue has been resolved in versions 2.6.5 and 2.7.5 and later

Affected products (as reported)

Vendor	Product	Versions
Combodo	iTop	< 2.6.5>= 2.7.0, < 2.7.5

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

References

https://github.com/Combodo/iTop/security/advisories/GHSA-ghqc-r8f6-q9m9 x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/43daa2ef088bf928a2386fa19324628c3f19b807 x_refsource_MISC
https://github.com/Combodo/iTop/commit/6be9a87c150978752bc68baae1a5c4833ddadfec x_refsource_MISC