CVE-2021-41245

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, CSRF tokens generated by `privUITransactionFile` aren't properly checked. Versions 2.7.6 and 3.0.0 contain a patch for this issue. As a workaround, use the session implementation by adding in the iTop config file.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Apr 5, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-412468.8Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and includinCVE-2021-412477.5JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in tCVE-2021-412484.7GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation. All versions of grCVE-2021-412494.7GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. All versions of graphql-playground-react older than graCVE-2021-41258.1It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as CVE-2021-412504.3Python discord bot is the community bot for the Python Discord community. In affected versions when a non-blacklisted URL and an otherwise tCVE-2021-412515.9@sap-cloud-sdk/core contains the core functionality of the SAP Cloud SDK as well as the SAP Business Technology Platform abstractions. This CVE-2021-412525.4Kirby is an open source file structured CMS ### Impact Kirby's writer field stores its formatted content as HTML code. Unlike with other fieCVE-2021-412538.1Zydis is an x86/x86-64 disassembler library. Users of Zydis versions v3.2.0 and older that use the string functions provided in `zycore` in CVE-2021-412548.8kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for infrastructure and workloads definedCVE-2021-412567.1nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app CVE-2021-412585.4Kirby is an open source file structured CMS. In affected versions Kirby's blocks field stores structured data for each block. This data is t