CVE-2025-24021
- Source
- https://cve.org/CVERecord?id=CVE-2025-24021
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-24021.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-24021
- Aliases
-
- GHSA-c8hm-h9gv-8jpj
- Published
- 2025-05-14T14:48:42.694Z
- Modified
- 2026-08-12T03:51:36.400247686Z
- Severity
-
- 5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N CVSS Calculator
- Summary
- iTop doesn't have mass assignment of fields in the portal form
- Details
-
iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to object fields when they're not supposed to. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-862" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24021.json" }- References
Affected packages
Git / github.com/combodo/itop
Affected ranges
- Type
- GIT
- Repo
- https://github.com/combodo/itop
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroducedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "2.7.12" }, { "introduced": "3.0.0" }, { "fixed": "3.1.3" }, { "introduced": "3.2.0" }, { "fixed": "3.2.1" } ], "source": [ "CPE_RANGE", "REFERENCES" ], "cpe": "cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*" }
Affected versions
1.*
1.0.8
2.*
2.6.1
2.6.2
2.6.3
2.7.0-alpha1
2.7.0-beta
2.7.0-beta2
2.7.1
2.7.10
2.7.11
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
3.*
3.1.0-alpha1
3.1.0-designer-2
3.1.1
3.1.1-1
3.1.2
3.2.0-alpha1
3.2.0-rc1
3.2.0-rc2
3.2.0-rc3
ITSM_Designer_3.*
ITSM_Designer_3.1-compatibility
Other
N1963
N2011
N2016
N941
N941-2