CVE-2021-32663

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authentication. Given specific parameters this can lead to SSRF. This issue has been resolved in versions 2.6.5 and 2.7.5 and later

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Oct 19, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-326644.8Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page w CVE-2021-326656.5wire-ios is the iOS version of Wire, an open-source secure messaging app. wire-ios versions 3.8.0 and earlier have a bug in which a conversa CVE-2021-326666.5wire-ios is the iOS version of Wire, an open-source secure messaging app. In wire-ios versions 3.8.0 and prior, a vulnerability exists that CVE-2021-326675.4TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 1 CVE-2021-326684.8TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 1 CVE-2021-326695.4TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 1 CVE-2021-32677.2File Upload vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the uploadFile function.CVE-2021-326706.1Datasette is an open source multi-tool for exploring and publishing data. The `?_trace=1` debugging feature in Datasette does not correctly CVE-2021-3267110.0Flarum is a forum software for building communities. Flarum's translation system allowed for string inputs to be converted into HTML DOM nod CVE-2021-326724.3Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that CVE-2021-326739.8reg-keygen-git-hash-plugin is a reg-suit plugin to detect the snapshot key to be compare with using Git commit hash. reg-keygen-git-hash-plu CVE-2021-326748.8Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/securit