← Vulnerability feed

Vulnerability record · CVE-2022-24780 · published 5 April 2022

CVE-2022-24780: Combodo itop code injection vulnerability

Combodo · Itop

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.

8.8 CVSS 3.1 High EPSS 5.7% · top 7.3% CWE-94 · Code injection
8.8CVSS 3.1 base score, v2 6.5
5.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/167236/iTop-Remote-Command-Execution.html ExploitThird Party AdvisoryVDB Entry
https://github.com/Combodo/iTop/commit/93f273a28778e5da8e51096f021d2dc1adbf4ef3 PatchThird Party Advisory
https://github.com/Combodo/iTop/commit/b6fac4b411b8d145fc30fa35c66b51243eafd06b PatchThird Party Advisory
https://github.com/Combodo/iTop/commit/eb2a615bd28100442c7f6171707bb40884af2305 PatchThird Party Advisory
https://github.com/Combodo/iTop/security/advisories/GHSA-v97m-wgxq-rh54 Third Party Advisory
https://markus-krell.de/itop-template-injection-inside-customer-portal/ ExploitThird Party Advisory
http://packetstormsecurity.com/files/167236/iTop-Remote-Command-Execution.html ExploitThird Party AdvisoryVDB Entry
https://github.com/Combodo/iTop/commit/93f273a28778e5da8e51096f021d2dc1adbf4ef3 PatchThird Party Advisory
https://github.com/Combodo/iTop/commit/b6fac4b411b8d145fc30fa35c66b51243eafd06b PatchThird Party Advisory
https://github.com/Combodo/iTop/commit/eb2a615bd28100442c7f6171707bb40884af2305 PatchThird Party Advisory
https://github.com/Combodo/iTop/security/advisories/GHSA-v97m-wgxq-rh54 Third Party Advisory
https://markus-krell.de/itop-template-injection-inside-customer-portal/ ExploitThird Party Advisory

Track CVE-2022-24780 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-48710Combodo itop vulnerabilityiTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted access. Ho…EPSS 0.72%9.8CVE-2022-39216Combodo itop vulnerabilityCombodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, the reset password token is generated …EPSS 0.91%9.6CVE-2024-54139Combodo itop cross-site scripting vulnerabilityCombodo iTop is an open source and web-based IT service management platform. Prior to versions 2.7.11, 3.1.2, and 3.2.0., iTop has a cross-site scrip…EPSS 0.22%8.8CVE-2024-52002Combodo itop cross-site request forgery vulnerabilityCombodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to a Cross-Site Request Forgery (CSRF) vulnerabilit…EPSS 0.66%8.8CVE-2024-51740Combodo itop server-side request forgery (ssrf) vulnerabilityCombodo iTop is a simple, web based IT Service Management tool. This vulnerability can be used to create HTTP requests on behalf of the server, from …EPSS 0.54%8.8CVE-2024-31998Combodo itop cross-site request forgery vulnerabilityCombodo iTop is a simple, web based IT Service Management tool. A CSRF can be performed on CSV import simulation. This issue has been fixed in versio…EPSS 0.24%8.8CVE-2021-32776Combodo itop cross-site request forgery vulnerabilityCombodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Windows serv…EPSS 0.38%8.8CVE-2021-21406Combodo itop command injection vulnerabilityCombodo iTop is an open source, web based IT Service Management tool. In versions prior to 2.7.4, there is a command injection vulnerability in the S…EPSS 1.0%

Source: NIST National Vulnerability Database (record CVE-2022-24780), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.