CVE-2022-39214— Authenticated users of Combodo iTop can take over any account
Quick assessment
Affected
Combodo iTop
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Combodo iTop是法国Combodo公司的一套基于ITIL开发且用于IT环境日常运营的开源Web应用程序。该程序提供事件管理、配置管理和问题管理等功能。 Combodo iTop 2.7.8 之前和 3.0.2-1 之前版本存在安全漏洞，该漏洞源于可以登录 iTop 的用户只要知道帐户的用户名就可以接管任何帐户。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-39214
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Authenticated users of Combodo iTop can take over any account
Source: CVE Program / CVE List V5
Vulnerability Description
Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, a user who can log in on iTop is able to take over any account just by knowing the account's username. This issue is fixed in versions 2.7.8 and 3.0.2-1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
Combodo iTop 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Combodo iTop是法国Combodo公司的一套基于ITIL开发且用于IT环境日常运营的开源Web应用程序。该程序提供事件管理、配置管理和问题管理等功能。 Combodo iTop 2.7.8 之前和 3.0.2-1 之前版本存在安全漏洞，该漏洞源于可以登录 iTop 的用户只要知道帐户的用户名就可以接管任何帐户。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-39214
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-39214
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-39214 (2)
Vendor Advisories for CVE-2022-39214 (1)
-
https://github.com/Combodo/iTop/security/advisories/GHSA-vj96-j84g-jhx4 x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: iTop
-
CVE-2026-40877
Combodo iTop: PHP Object Injection Leading to Remote Code Ex -
CVE-2026-30864
Combodo iTop: Reflected XSS in dashboard revert -
CVE-2026-39975
Combodo iTop: Remote code execution using external auth vari -
CVE-2026-34949
Combodo iTop: Unauthenticated user can delete .readonly file -
CVE-2026-34948
Combodo iTop: Access control bypass via OQL joins
Same vendor: Combodo
-
CVE-2026-40877
Combodo iTop: PHP Object Injection Leading to Remote Code Ex -
CVE-2026-30864
Combodo iTop: Reflected XSS in dashboard revert -
CVE-2026-39975
Combodo iTop: Remote code execution using external auth vari -
CVE-2026-34949
Combodo iTop: Unauthenticated user can delete .readonly file -
CVE-2026-34948
Combodo iTop: Access control bypass via OQL joins
Same weakness: CWE-863
-
CVE-2026-77611
SeaweedFS: Authenticated S3 object-scope bypass in PutObject -
CVE-2026-43621
Simple Machines Forum < 2.1.7 Authorization Confusion via Pr -
CVE-2026-77317
SeaweedFS: SFTP path ACL literal prefix match permits cross- -
CVE-2026-77298
SeaweedFS S3 OIDC Bearer authentication bypasses IAM role tr -
CVE-2026-66003
Frappe: Access control bypass via REST API dot-notation fiel
V. Comments for CVE-2022-39214
No comments yet