CVE-2021-32663: Unauthorized setup leads to SSRF in Combodo/iTop
iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authentication. Given specific parameters this can lead to SSRF. This issue has been resolved in versions 2.6.5 and 2.7.5 and later
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-32663?
CVE-2021-32663 is classified as a critical vulnerability due to the potential for unauthenticated system setup access leading to SSRF.
How do I fix CVE-2021-32663?
To fix CVE-2021-32663, upgrade iTop to version 2.6.5, 2.7.5 or later.
What versions are affected by CVE-2021-32663?
Affected versions of iTop are prior to 2.6.5 and version 2.7.0 to 2.7.4 inclusively.
What attack vector is exploited in CVE-2021-32663?
CVE-2021-32663 can be exploited by an attacker invoking the system setup without authentication.
What could be the impact of CVE-2021-32663 on an organization?
The impact of CVE-2021-32663 could include unauthorized access to internal resources and potential data leakage due to SSRF exploitation.