Vulnerability · Published Mar 14, 2023 · Assigned by GitHub_M
CVE-2022-39214Authenticated users of Combodo iTop can take over any account
Critical 9.6
In plain English
A critical-severity incorrect authorization in iTop from Combodo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 25.6% (higher than 98% of all known vulnerabilities).
Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)25.6%top 2.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, a user who can log in on iTop is able to take over any account just by knowing the account's username. This issue is fixed in versions 2.7.8 and 3.0.2-1.
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N