Vulnerability · Published Nov 4, 2024 · Assigned by GitHub_M

CVE-2024-32870iTop hub connector Information disclosure

Medium 5.8

In plain English

A medium-severity information exposure in iTop from Combodo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)5.8Medium

Exploit odds (30 days)0.8%top 44.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info (name, version and parameters) can be read by anyone having access to iTop URI. This issue has been patched in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
Combodo	iTop	< 2.7.11>= 3.0.0, < 3.0.5>= 3.1.0, < 3.1.2

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

References

https://github.com/Combodo/iTop/security/advisories/GHSA-rfjh-2f5x-qxmx x_refsource_CONFIRM