CVE-2021-21407CWE-352

Portal : the CSRF token isn't validated

High · published July 21, 2021

CVSS v3.1
8.0
EPSS
0%
Percentile
39.0
In the wild
Unconfirmed
What it is

Combodo iTop is an open source, web based IT Service Management tool. Prior to version 2.7.4, the CSRF token validation can be bypassed through iTop portal via a tricky browser procedure. The vulnerability is patched in version 2.7.4 and 3.0.0.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00461 · 39.0th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2021-07-21T15:15Z
EPSS history
Timeline
  • 21 JUL 15:15Z
    Portal : the CSRF token isn't validated
    cvelistv5