CVE-2025-24021

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-24021
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-24021.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-24021
Aliases
  • GHSA-c8hm-h9gv-8jpj
Published
2025-05-14T14:48:42.694Z
Modified
2026-04-10T05:22:55.900549Z
Severity
  • 5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N CVSS Calculator
Summary
iTop doesn't have mass assignment of fields in the portal form
Details

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to object fields when they're not supposed to. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24021.json",
    "cwe_ids": [
        "CWE-862"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/combodo/itop

Affected ranges

Type
GIT
Repo
https://github.com/combodo/itop
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
affed699991f19f2400daea698764ed14fbf407b
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.7.12"
        }
    ]
}
Type
GIT
Repo
https://github.com/combodo/itop
Events
Introduced
682c821d0ef14224b2182ea5840ae1739600bc22
Fixed
46aaeb43016b2f0de8b14881c99cb435428bc789
Database specific 
{
    "versions": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.1.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/combodo/itop
Events
Introduced
0ee1818f12583de75babc5c9e4fd6428cc8fdb73
Fixed
a9bc4973b40a4834228fefec69646a8738d3f82e
Database specific 
{
    "versions": [
        {
            "introduced": "3.2.0"
        },
        {
            "fixed": "3.2.1"
        }
    ]
}

Affected versions

1.*
1.0.8
2.*
2.6.1
2.6.2
2.6.3
2.7.1
2.7.10
2.7.11
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
Other
N1963
N2011
N2016
N941
N941-2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-24021.json"