CVE-2024-52601 | THREATINT

Description

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access to objects they're not allowed to see by querying an unprotected route. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.

PUBLISHED Reserved 2024-11-14 | Published 2025-05-14 | Updated 2025-05-14 | Assigner GitHub_M

MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Problem types

CWE-639: Authorization Bypass Through User-Controlled Key

Product status

< 2.7.12

affected

>= 3.0.0, < 3.1.3

affected

>= 3.2.0, < 3.2.1

affected

References

github.com/...o/iTop/security/advisories/GHSA-cph2-466c-3f87

cve.org (CVE-2024-52601)

nvd.nist.gov (CVE-2024-52601)

Download JSON