CVE-2022-24780

CVE-2022-24780 is a critical vulnerability affecting Combodo iTop versions prior to 2.7.6 and 3.0.0, allowing authenticated users of the iTop user portal to execute arbitrary code on the server. This is achieved by forging specific HTTP queries containing TWIG code, leading to server compromise with HTTP server user privileges. The vulnerability carries a high CVSS score of 8.8, indicating a network-based attack with low privileges and no user interaction required, resulting in high impacts to confidentiality, integrity, and availability. While there are no known public exploits or active exploitation, and minimal community discussion, the high FAUCET Risk Score of 91/100 suggests a significant potential for exploitation.