CVE-2022-24780: Code Injection in Combodo iTop
Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-24780?
CVE-2022-24780 is a vulnerability in Combodo iTop versions prior to 2.7.6 and 3.0.0 that allows users of the iTop user portal to execute arbitrary code on the server using HTTP server user privileges.
What is the severity of CVE-2022-24780?
CVE-2022-24780 has a severity of 8.8 (high).
How does CVE-2022-24780 affect Combodo iTop?
CVE-2022-24780 affects Combodo iTop versions prior to 2.7.6 and 3.0.0.
How can I fix CVE-2022-24780?
To fix CVE-2022-24780, users should update to version 2.7.6 or 3.0.0 of Combodo iTop.
Where can I find more information about CVE-2022-24780?
More information about CVE-2022-24780 can be found at the following references: [link1](http://packetstormsecurity.com/files/167236/iTop-Remote-Command-Execution.html) and [link2](https://github.com/Combodo/iTop/commit/93f273a28778e5da8e51096f021d2dc1adbf4ef3) and [link3](https://github.com/Combodo/iTop/commit/b6fac4b411b8d145fc30fa35c66b51243eafd06b).