Combodo iTop (aka IT Operations Portal)

Any user can see any fields (including mailbox password) with GroupBy Dashlet

iTop 2.2.0 through 2.6.0 allows remote attackers to cause a denial of service (application outage) via many requests to launch a compile operation. The requests use the pages/exec.php?exec_env=production&exec_module=itop-hub-connector&exec_page=ajax.php&operation=compile URI. This only affects the community version.

Combodo iTop - Broken Access Control

Users enumeration allowed through Rest API in Combodo iTop

Combodo iTop - Security Misconfiguration

Combodo iTop - Reflected XSS

Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary commands by changing the platform configuration, because web/env-production/itop-config/config.php contains a function called TestConfig() that calls the vulnerable function eval().

Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTop

Cross-site Scripting in portal picture upload in Combodo iTop

Combodo iTop vulnerable to reflected XSS in webservices/export.php

Admin pages are cached and can be embedded

Combodo iTop - Stored XSS

XSS in the breadcrumbs

iTop vulnerable to XSS in dashlet modifications ajax endpoints

Combodo iTop vulnerable to stored self Cross-site Scripting in preferences

iTop portal Insecure Direct Object Reference vulnerability

iTop vulnerable to Self XSS in CSV Import

Cross-site scripting (XSS) vulnerability in application/dashboard.class.inc.php in Combodo iTop before 2.2.0-2459 allows remote attackers to inject arbitrary web script or HTML via a dashboard title.

ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/webservices/export-v2.php.

ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/pages/ajax.render.php.

Because of a lack of sanitization around error messages, multiple Reflective XSS issues exist in iTop through 2.6.0 via the param_file parameter to webservices/export.php, webservices/cron.php, or env-production/itop-backup/backup.php. By default, any XSS sent to the administrator can be transformed to remote command execution because of CVE-2018-10642 (still working through 2.6.0) The Reflective XSS can also become a stored XSS within the same account because of another vulnerability.

Cross Site Scripting vulnerability in Combodo iTop v.3.1.0-2-11973 allows a local attacker to obtain sensitive information via a crafted script to the attrib_manager_id parameter in the General Information page and the id parameter in the contact page.

In iTop through 2.6.0, an XSS payload can be delivered in certain fields (such as icon) of the XML file used to build the dashboard. This is similar to CVE-2015-6544 (which is only about the dashboard title).

Session fixation

In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community, essential, professional) in version 2.7.0 and iTop essential and iTop professional in version 2.6.4.

In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4.

iTop hub connector Information disclosure

iTop vulnerable to XSS in friendlyname in object details

Cross-site Scripting in Combodo iTop

iTop missing silo check on extkey in console and portal

iTop Inefficient Regular Expression Complexity vulnerability

iTop Dashboard editor vulnerable dashboard config file parameter

iTop portal user can see any other contact's picture

iTop doesn't have mass assignment of fields in the portal form

Multiple cross-site scripting (XSS) vulnerabilities in the search feature in iTop (aka IT Operations Portal) 2.0, 1.2.1, 1.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to pages/UI.php or (2) expression parameter to pages/run_query.php. NOTE: some of these details are obtained from third party information.

Multiple cross-site scripting (XSS) vulnerabilities in iTop (aka IT Operations Portal) 1.1.181 and 1.2.0-RC-282 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted company name, (2) a crafted database server name, (3) a crafted CSV file, (4) a crafted copy-and-paste action, (5) the auth_user parameter in a suggest_pwd action to UI.php, (6) the c[menu] parameter to UniversalSearch.php, (7) the description parameter in a SearchFormToAdd_document_list action to UI.php, (8) the category parameter in an errors action to audit.php, or (9) the suggest_pwd parameter to UI.php.

SQL query displayed on portal error

Portal user is able to access forbidden services information in Combodo iTop

iTop dashboard vulnerable to denial of service

Combodo iTop vulnerable to IDOR with ModuleInstallation object