CVE-2022-24780

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 2.7.6 and 3.0.0

Description The issue is related to incorrect code generation management in the iTop web-based IT Service Management tool. It allows users of the iTop user portal to send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges.

Recommendations For versions prior to 2.7.6, update to version 2.7.6 or later. For versions prior to 3.0.0, update to version 3.0.0 or later. As a temporary workaround, consider restricting access to the iTop user portal until a patch is applied.