CVE-2025-24021CWE-862

iTop doesn't have mass assignment of fields in the portal form

Medium · published May 14, 2025

CVSS v3.1
5.0
EPSS
0%
Percentile
17.8
In the wild
Unconfirmed
What it is

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to object fields when they're not supposed to. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00267 · 17.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-05-14T14:48Z
EPSS history
Timeline
  • 14 MAY 14:48Z
    iTop doesn't have mass assignment of fields in the portal form
    cvelistv5