CVE-2025-24022

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-24022
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-24022.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-24022
Aliases
  • GHSA-rhv2-wfrr-4j2j
Published
2025-05-14T14:57:37.960Z
Modified
2026-04-10T05:22:55.658939Z
Severity
  • 8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
iTop server vulnerable to portal code injection
Details

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, server code execution is possible through the frontend of iTop's portal. This is fixed in versions 2.7.12, 3.1.3 and 3.2.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24022.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-78"
    ]
}
References

Affected packages

Git / github.com/combodo/itop

Affected ranges

Type
GIT
Repo
https://github.com/combodo/itop
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
affed699991f19f2400daea698764ed14fbf407b
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.7.12"
        }
    ]
}
Type
GIT
Repo
https://github.com/combodo/itop
Events
Introduced
682c821d0ef14224b2182ea5840ae1739600bc22
Fixed
46aaeb43016b2f0de8b14881c99cb435428bc789
Database specific 
{
    "versions": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.1.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/combodo/itop
Events
Introduced
0ee1818f12583de75babc5c9e4fd6428cc8fdb73
Fixed
a9bc4973b40a4834228fefec69646a8738d3f82e
Database specific 
{
    "versions": [
        {
            "introduced": "3.2.0"
        },
        {
            "fixed": "3.2.1"
        }
    ]
}

Affected versions

1.*
1.0.8
2.*
2.6.1
2.6.2
2.6.3
2.7.1
2.7.10
2.7.11
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
Other
N1963
N2011
N2016
N941
N941-2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-24022.json"