CVE Feed

    Dashboard / CVE / CVE-2022-24780

    CVE-2022-24780

    Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.

    Published:Apr 5, 2022
    Last Modified:Apr 22, 2025
    EPS:Apr 5, 2022
    EPSS Score:0.16404
    CVSS Score:8.8

    Affected Products

    Vendor
    Combodo
    Product
    Itop

    Exploits

    http://packetstormsecurity.com/files/167236/iTop-Remote-Command-Execution.htmlhttps://markus-krell.de/itop-template-injection-inside-customer-portal/http://packetstormsecurity.com/files/167236/iTop-Remote-Command-Execution.htmlhttps://markus-krell.de/itop-template-injection-inside-customer-portal/https://github.com/Acceis/exploit-CVE-2022-24780

    Related CVEs

    CVE-2026-40877 (CVSS 8.7) — Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injec…
    CVE-2026-30864 (CVSS 8.9) — Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-…
    CVE-2026-39975 (CVSS 9.4) — Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the…
    CVE-2026-34949 (CVSS 6.5) — Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete th…
    CVE-2026-34948 (CVSS 7.7) — Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT cla…
    CVE-2026-34836 (CVSS 6.5) — Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render…
    CVE-2026-34741 (CVSS 8.6) — Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthent…
    CVE-2026-33333 (CVSS 3.5) — Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclos…
    CVE-2026-33240 (CVSS 8.8) — Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scrip…
    CVE-2026-33047 (CVSS 4.3) — Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who …

    References

    http://packetstormsecurity.com/files/167236/iTop-Remote-Command-Execution.html
    https://github.com/Combodo/iTop/commit/93f273a28778e5da8e51096f021d2dc1adbf4ef3
    https://github.com/Combodo/iTop/commit/b6fac4b411b8d145fc30fa35c66b51243eafd06b
    https://github.com/Combodo/iTop/commit/eb2a615bd28100442c7f6171707bb40884af2305
    https://github.com/Combodo/iTop/security/advisories/GHSA-v97m-wgxq-rh54
    https://markus-krell.de/itop-template-injection-inside-customer-portal/
    http://packetstormsecurity.com/files/167236/iTop-Remote-Command-Execution.html
    https://github.com/Combodo/iTop/commit/93f273a28778e5da8e51096f021d2dc1adbf4ef3
    https://github.com/Combodo/iTop/commit/b6fac4b411b8d145fc30fa35c66b51243eafd06b
    https://github.com/Combodo/iTop/commit/eb2a615bd28100442c7f6171707bb40884af2305
    https://github.com/Combodo/iTop/security/advisories/GHSA-v97m-wgxq-rh54
    https://markus-krell.de/itop-template-injection-inside-customer-portal/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High