CVE-2024-51739

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a valid account. As a fix the sentence displayed after resetting password no longer shows if the user exists or not. This fix is included in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. Users unable to upgrade may overload the dictionary entry `"UI:ResetPwd-Error-WrongLogin"` through an extension and replace it with a generic message.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200CWE-203

Affected software

No affected versions have been published.

Timeline

Published
Nov 5, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-51745.3A flaw in Gliffy results in broken authentication through the reset functionality of the application.CVE-2024-517408.8Combodo iTop is a simple, web based IT Service Management tool. This vulnerability can be used to create HTTP requests on behalf of the servCVE-2024-517414.4Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL seCVE-2024-517438.8MarkUs is a web application for the submission and grading of student assignments. In versions prior to 2.4.8, an arbitrary file write vulneCVE-2024-517443.1golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situationCVE-2024-5174510.0Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special deviCVE-2024-517461.8Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry tCVE-2024-517477.2Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can read and delete arbitrarCVE-2024-517487.2Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can run arbitrary php code oCVE-2024-517493.5Element is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if thCVE-2024-517505.0Element is a Matrix web client built using the Matrix React SDK. A malicious homeserver can send invalid messages over federation which can CVE-2024-517516.5Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are
CVE-2024-51739: Medium severity, CVSS 5.3 | Vulnix