CVE-2024-51740

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Combodo iTop is a simple, web based IT Service Management tool. This vulnerability can be used to create HTTP requests on behalf of the server, from a low privileged user. The user portal form manager has been fixed to only instantiate classes derived from it. This issue has been addressed in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Nov 5, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-517414.4Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL se CVE-2024-517438.8MarkUs is a web application for the submission and grading of student assignments. In versions prior to 2.4.8, an arbitrary file write vulne CVE-2024-517443.1golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation CVE-2024-5174510.0Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special devi CVE-2024-517461.8Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry t CVE-2024-517477.2Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can read and delete arbitrar CVE-2024-517487.2Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can run arbitrary php code o CVE-2024-517493.5Element is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if th CVE-2024-517505.0Element is a Matrix web client built using the Matrix React SDK. A malicious homeserver can send invalid messages over federation which can CVE-2024-517516.5Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are CVE-2024-517525.5The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. I CVE-2024-517532.1The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In af