CVE-2024-52601CWE-639

iTop portal Insecure Direct Object Reference vulnerability

Medium · published May 14, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
27.2
In the wild
Unconfirmed
What it is

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access to objects they're not allowed to see by querying an unprotected route. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00348 · 27.2th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-05-14T14:39Z
EPSS history
Timeline
  • 14 MAY 14:39Z
    iTop portal Insecure Direct Object Reference vulnerability
    cvelistv5