CVE-2024-52601: iTop portal Insecure Direct Object Reference vulnerability
iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access to objects they're not allowed to see by querying an unprotected route. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52601?
CVE-2024-52601 is classified as a high-severity vulnerability due to unauthorized access to sensitive information.
How do I fix CVE-2024-52601?
To fix CVE-2024-52601, update your iTop installation to version 2.7.12, 3.1.3, or 3.2.1 or later.
Who is affected by CVE-2024-52601?
CVE-2024-52601 affects all versions of iTop prior to 2.7.12, 3.1.3, and 3.2.1.
What kind of access does CVE-2024-52601 allow?
CVE-2024-52601 allows users with portal access to read objects they should not have access to via an unprotected route.
Is CVE-2024-52601 a remote vulnerability?
CVE-2024-52601 is considered a remote vulnerability as it can be exploited by any authenticated user with portal access.