CVE-2024-52601

Description

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access to objects they're not allowed to see by querying an unprotected route. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.

Reserved 2024-11-14 | Published 2025-05-14 | Updated 2025-05-14 | Assigner GitHub_M

Problem types

CWE-639: Authorization Bypass Through User-Controlled Key

Product status

< 2.7.12
affected

>= 3.0.0, < 3.1.3
affected

>= 3.2.0, < 3.2.1
affected

References

github.com/...o/iTop/security/advisories/GHSA-cph2-466c-3f87

cve.org (CVE-2024-52601)

nvd.nist.gov (CVE-2024-52601)

Download JSON