What’s Vulnerable › Vulnerabilities

CVE-2021-32663: Unauthorized setup leads to SSRF in Combodo/iTop

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-10-19 · updated 2026-06-17
• Weakness: CWE-918

Description

iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authentication. Given specific parameters this can lead to SSRF. This issue has been resolved in versions 2.6.5 and 2.7.5 and later

Affected products

• Combodo iTop: before 2.6.5; from 2.7.0 before 2.7.5 — fixed in 2.6.5, 2.7.5

How to fix

Upgrade to a fixed version: Combodo iTop 2.6.5, 2.7.5. Check the vendor advisory for mitigations.

References

• https://github.com/Combodo/iTop/commit/43daa2ef088bf928a2386fa19324628c3f19b807
• https://github.com/Combodo/iTop/commit/6be9a87c150978752bc68baae1a5c4833ddadfec
• https://github.com/Combodo/iTop/security/advisories/GHSA-ghqc-r8f6-q9m9
• https://github.com/Combodo/iTop/commit/43daa2ef088bf928a2386fa19324628c3f19b807
• https://github.com/Combodo/iTop/commit/6be9a87c150978752bc68baae1a5c4833ddadfec
• https://github.com/Combodo/iTop/security/advisories/GHSA-ghqc-r8f6-q9m9

Get alerted when CVE-2021-32663 or the next vulnerability affects your stack