{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-02T10:01:03.260","vulnerabilities":[{"cve":{"id":"CVE-2024-51995","sourceIdentifier":"security-advisories@github.com","published":"2024-11-07T18:15:18.787","lastModified":"2026-06-17T08:06:46.160","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Combodo iTop is a web based IT Service Management tool. An attacker can request any `route` we want as long as we specify an `operation` that is allowed. This issue has been addressed in version 3.2.0 by applying the same access control pattern as in `UI.php` to the `ajax.render.php` page which does not allow arbitrary `routes` to be dispatched. All users are advised to upgrade. There are no known workarounds for this vulnerability."},{"lang":"es","value":"Combodo iTop es una herramienta de gestión de servicios de TI basada en la web. Un atacante puede solicitar cualquier «ruta» que queramos siempre que especifiquemos una «operación» que esté permitida. Este problema se ha solucionado en la versión 3.2.0 aplicando el mismo patrón de control de acceso que en «UI.php» a la página «ajax.render.php», que no permite enviar «rutas» arbitrarias. Se recomienda a todos los usuarios que actualicen la versión. No existen workarounds para esta vulnerabilidad."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Combodo","product":"iTop","versions":[{"version":"< 3.2.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":4.7}],"cvssMetricV30":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-11-07T18:16:46.169964Z","id":"CVE-2024-51995","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*","versionEndExcluding":"3.2.0","matchCriteriaId":"A59157AC-6016-4FB6-A3BD-08EAB161CF96"}]}]}],"references":[{"url":"https://github.com/Combodo/iTop/security/advisories/GHSA-3mxr-8r3j-j2j9","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}}]}