CVE-2021-32663CWE-918

Unauthorized setup leads to SSRF in Combodo/iTop

High · published October 19, 2021

CVSS v3.1
8.7
EPSS
1%
Percentile
73.4
In the wild
Unconfirmed
What it is

iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authentication. Given specific parameters this can lead to SSRF. This issue has been resolved in versions 2.6.5 and 2.7.5 and later

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01461 · 73.4th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2021-10-19T17:40Z
EPSS history
Timeline
  • 19 OCT 17:40Z
    Unauthorized setup leads to SSRF in Combodo/iTop
    cvelistv5