CVE-2021-41245

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, CSRF tokens generated by `privUITransactionFile` aren't properly checked. Versions 2.7.6 and 3.0.0 contain a patch for this issue. As a workaround, use the session implementation by adding in the iTop config file.

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CVSS v2.0

5.8 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:P

EPSS

0.70% chance of exploitation in the next 30 days, 51th percentile

Published

2022-04-05

Updated

2025-04-22

Proof-of-concept exploits (1)

• https://huntr.dev/bounties/0a39630d-f4b9-4468-86d8-aea3b02f91ae

References

• CVE Record
• NVD entry

Related

• CVE-2021-4124
• CVE-2021-41253
• CVE-2021-4123
• CVE-2021-41254
• CVE-2021-4121
• CVE-2021-41256