HIGH🇵🇱 Wersja polska

CVE-2025-47286

CVSS 8.6v4.0pub. 2025-11-10upd. 2025-11-21

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, an administrator can, by editing the configuration of the iTop instance, execute code on the server. Versions 2.7.13 and 3.2.2 escape and check the config parameter before executing a command based on it.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Combodo Itop

    APP
    Combodo
    < 2.7.133.0.0 – 3.2.2 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-48710CRITICAL9.8PL ✓same product

Combodo iTop: nieautoryzowany dostęp do plików z folderu env-production

CVE-2022-39214CRITICAL9.6PL ✓same product

Combodo iTop — przejęcie konta przez znajomość nazwy użytkownika

CVE-2021-41162CRITICAL9.3PL ✓same product

Combodo iTop — XSS w parametrach strony ajax.render.php

CVE-2021-41161CRITICAL9.3PL ✓same product

XSS w Combodo iTop — wstrzyknięcie JavaScript przy eksporcie CSV

CVE-2025-47773HIGH8.8same product

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to c...