CVE-2024-52001— Portal user is able to access forbidden services information in Combodo iTop
Quick assessment
Affected
Combodo iTop
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Combodo iTop是法国Combodo公司的一套基于ITIL开发且用于IT环境日常运营的开源Web应用程序。该程序提供事件管理、配置管理和问题管理等功能。 Combodo iTop 3.2.0版本之前存在信息泄露漏洞，该漏洞源于在受影响的版本中，门户用户可以访问被禁止的服务信息。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-52001
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Portal user is able to access forbidden services information in Combodo iTop
Source: CVE Program / CVE List V5
Vulnerability Description
Combodo iTop is a simple, web based IT Service Management tool. In affected versions portal users are able to access forbidden services information. This issue has been addressed in version 3.2.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Combodo iTop 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Combodo iTop是法国Combodo公司的一套基于ITIL开发且用于IT环境日常运营的开源Web应用程序。该程序提供事件管理、配置管理和问题管理等功能。 Combodo iTop 3.2.0版本之前存在信息泄露漏洞，该漏洞源于在受影响的版本中，门户用户可以访问被禁止的服务信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-52001
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-52001
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-52001 (1)
Same Patch Batch · Combodo · 2024-11-08 · 3 CVEs total
| CVE-2024-52000 | Reflected Cross-site Scripting exploit in Combodo iTop | |
| CVE-2024-52002 | Cross-Site Request Forgery (CSRF) in several iTop pages |
IV. Related Vulnerabilities
Same product: iTop
-
CVE-2026-34949
Combodo iTop: Unauthenticated user can delete .readonly file -
CVE-2026-34948
Combodo iTop: Access control bypass via OQL joins -
CVE-2026-34836
Combodo iTop: Improper access control in ajax.render.php and -
CVE-2026-34741
Combodo iTop: Authentication bypass in exec.php allows PHP f -
CVE-2026-33333
Combodo iTop: Information disclosure in ajax.render.php
Same vendor: Combodo
-
CVE-2026-34949
Combodo iTop: Unauthenticated user can delete .readonly file -
CVE-2026-34948
Combodo iTop: Access control bypass via OQL joins -
CVE-2026-34836
Combodo iTop: Improper access control in ajax.render.php and -
CVE-2026-34741
Combodo iTop: Authentication bypass in exec.php allows PHP f -
CVE-2026-33333
Combodo iTop: Information disclosure in ajax.render.php
Same weakness: CWE-200
-
CVE-2026-59256
WWBN AVideo Unbound Token Authorization Bypass via Gallery -
CVE-2026-56380
AVideo feed/index.php Exposure of Channel Owner Email Addres -
CVE-2026-48050
Arc: Unauthenticated access to Go debug pprof endpoints leak -
CVE-2026-34948
Combodo iTop: Access control bypass via OQL joins -
CVE-2026-53497
CrossWatch: Unauthenticated /api/app-auth/status endpoint le
V. Comments for CVE-2024-52001
No comments yet