CVE-2024-32870 is an information disclosure vulnerability affecting Combodo iTop, an IT Service Management tool. It allows unauthenticated attackers to retrieve sensitive server, OS, DBMS, PHP, and iTop configuration details by simply accessing the iTop URI. This vulnerability carries a CVSS score of 5.8 (Medium), indicating a low attack complexity and the potential for limited confidentiality impact, with no integrity or availability impact. While there are no known active exploits or Metasploit modules, a Nuclei template exists for detection, and there is minimal community discussion or media coverage surrounding this CVE. Patches are available in iTop versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0, and immediate upgrade is recommended as there are no workarounds.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.7.11CPE matchmatch criteria | cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:* | ||
>= 3.0.0, < 3.0.5CPE matchmatch criteria | cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:* | ||
>= 3.1.0, < 3.1.2CPE matchmatch criteria | cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.