CVE-2024-52601

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-52601
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-52601.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-52601
Aliases
  • GHSA-cph2-466c-3f87
Published
2025-05-14T14:39:15.120Z
Modified
2026-04-10T05:12:21.773166Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
iTop portal Insecure Direct Object Reference vulnerability
Details

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access to objects they're not allowed to see by querying an unprotected route. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52601.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/combodo/itop

Affected ranges

Type
GIT
Repo
https://github.com/combodo/itop
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
affed699991f19f2400daea698764ed14fbf407b
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.7.12"
        }
    ]
}
Type
GIT
Repo
https://github.com/combodo/itop
Events
Introduced
682c821d0ef14224b2182ea5840ae1739600bc22
Fixed
46aaeb43016b2f0de8b14881c99cb435428bc789
Database specific 
{
    "versions": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.1.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/combodo/itop
Events
Introduced
0ee1818f12583de75babc5c9e4fd6428cc8fdb73
Fixed
a9bc4973b40a4834228fefec69646a8738d3f82e
Database specific 
{
    "versions": [
        {
            "introduced": "3.2.0"
        },
        {
            "fixed": "3.2.1"
        }
    ]
}

Affected versions

1.*
1.0.8
2.*
2.6.1
2.6.2
2.6.3
2.7.1
2.7.10
2.7.11
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
Other
N1963
N2011
N2016
N941
N941-2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-52601.json"