CVE-2021-32663

high

Description

iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authentication. Given specific parameters this can lead to SSRF. This issue has been resolved in versions 2.6.5 and 2.7.5 and later

References

Advisories

https://github.com/Combodo/iTop/security/advisories/GHSA-ghqc-r8f6-q9m9

https://github.com/Combodo/iTop/commit/6be9a87c150978752bc68baae1a5c4833ddadfec

https://github.com/Combodo/iTop/commit/43daa2ef088bf928a2386fa19324628c3f19b807

Details

Source: Mitre, NVD

Published: 2021-10-19

Updated: 2021-10-22

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Severity: High

EPSS

EPSS: 0.003