CVE-2021-21406

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Combodo iTop is an open source, web based IT Service Management tool. In versions prior to 2.7.4, there is a command injection vulnerability in the Setup Wizard when providing Graphviz executable path. The vulnerability is patched in version 2.7.4 and 3.0.0.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
Combodo	iTop	< 2.7.4

References

https://github.com/Combodo/iTop/security/advisories/GHSA-pf95-6h7q-q85xThird Party Advisory
https://github.com/Combodo/iTop/security/advisories/GHSA-pf95-6h7q-q85xThird Party Advisory

Timeline

Published: Jul 21, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-214076.5Combodo iTop is an open source, web based IT Service Management tool. Prior to version 2.7.4, the CSRF token validation can be bypassed thro CVE-2021-214088.8Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.43 CVE-2021-214095.9Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance prot CVE-2021-21412.0Vulnerability in the Oracle FLEXCUBE Direct Banking product of Oracle Financial Services Applications (component: Pre Login). Supported vers CVE-2021-214109.1Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be triggered by 6Lo CVE-2021-214115.5OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The `--gitlab-group` flag CVE-2021-214128.8Potential for arbitrary code execution in npm package @thi.ng/egf `#gpg`-tagged property values (only if `decrypt: true` option is enabled).CVE-2021-214139.6isolated-vm is a library for nodejs which gives you access to v8's Isolate interface. Versions of isolated-vm before v4.0.0 have API pitfall CVE-2021-214147.2Prisma is an open source ORM for Node.js & TypeScript. As of today, we are not aware of any Prisma users or external consumers of the `@pris CVE-2021-214157.8Prisma VS Code a VSCode extension for Prisma schema files. This is a Remote Code Execution Vulnerability that affects all versions of the Pr CVE-2021-214162.6django-registration is a user registration package for Django. The django-registration package provides tools for implementing user-account CVE-2021-214175.5fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that