CVE-2025-49145: iTop admin can drop iTop database using webhooks
Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks (mostly administrators) can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49145?
CVE-2025-49145 is considered a critical vulnerability due to its potential to allow an authorized user to drop the database.
How do I fix CVE-2025-49145?
To fix CVE-2025-49145, upgrade to Combodo iTop version 2.7.13 or later, or 3.2.2 or later.
What versions of Combodo iTop are affected by CVE-2025-49145?
CVE-2025-49145 affects Combodo iTop versions prior to 2.7.13 and 3.2.2.
Who is at risk with CVE-2025-49145?
Administrators who have the rights to create webhooks in Combodo iTop versions prior to the fixed versions are at risk with CVE-2025-49145.
What security measures are implemented in the patch for CVE-2025-49145?
The patch for CVE-2025-49145 implements verification of the callback signature for webhooks to prevent database dropping.