CVE-2024-52601 — iTop portal Insecure Direct Object Reference vulnerability

CVE-2024-52601

iTop portal Insecure Direct Object Reference vulnerability PUBLISHED

Description (CNA)

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access to objects they're not allowed to see by querying an unprotected route. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.

Affected (CNA)

Vendor / product	Versions
Combodo / iTop	affected < 2.7.12; affected >= 3.0.0, < 3.1.3; affected >= 3.2.0, < 3.2.1

CWE

CWE-639

References

https://github.com/Combodo/iTop/security/advisories/GHSA-cph2-466c-3f87

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.