CVE-2024-51995

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Combodo iTop is a web based IT Service Management tool. An attacker can request any `route` we want as long as we specify an `operation` that is allowed. This issue has been addressed in version 3.2.0 by applying the same access control pattern as in `UI.php` to the `ajax.render.php` page which does not allow arbitrary `routes` to be dispatched. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Nov 7, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-519967.5Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me CVE-2024-519978.1Trustee is a set of tools and components for attesting confidential guests and providing secrets to them. The ART (**Attestation Results Tok CVE-2024-519988.6changedetection.io is a free open source web page change detection tool. The validation for the file URI scheme falls short, and results in CVE-2024-52004.8The Postie WordPress plugin before 1.9.71 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2024-520006.1Combodo iTop is a simple, web based IT Service Management tool. Affected versions are subject to a reflected Cross-site Scripting (XSS) expl CVE-2024-520014.3Combodo iTop is a simple, web based IT Service Management tool. In affected versions portal users are able to access forbidden services info CVE-2024-520028.8Combodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to a Cross-Site Request Forgery (CSRF) vul CVE-2024-520036.1Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provi CVE-2024-520048.7MediaCMS is an open source video and media CMS, written in Python/Django and React, featuring a REST API. MediaCMS has been prone to vulnera CVE-2024-520058.8Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported CVE-2024-520067.5Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and CVE-2024-520078.6HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various c