CVE-2025-24021

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to object fields when they're not supposed to. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Combodo	iTop	< 2.7.12; >= 3.0.0, < 3.1.3; >= 3.2.0, < 3.2.1

References

Timeline

Published: May 14, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-240228.5iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, server code execution is possible through the f CVE-2025-240235.3Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existin CVE-2025-240249.1Mjolnir is a moderation tool for Matrix. Mjolnir v1.9.0 responds to management commands from any room the bot is member of. This can allow u CVE-2025-240256.1Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.380, the tag CVE-2025-240265.3iTop is an web based IT Service Management tool. Versions prior to 3.2.1 are vulnerable to regular expression denial of service (ReDoS) that CVE-2025-240276.2ps_contactinfo, a PrestaShop module for displaying store contact information, has a cross-site scripting (XSS) vulnerability in versions up CVE-2025-240289.6Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vul CVE-2025-240295.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users (possibly anonymous ones if the widge CVE-2025-24037.5A denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanism exists in Relion 670/650 and S CVE-2025-240307.1Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access CVE-2025-240315.1PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. In versions 0.6.12 and prior, the pam_pkcs11 modul CVE-2025-240329.2PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. Prior to version 0.6.13, if cert_policy is set to