CVE-2024-52002 Cross-Site Request Forgery (CSRF) in several iTop pages

What is CVE-2024-52002?

CVE-2024-52002 is a high-severity vulnerability in Combodo Itop, published on 8 Nov 2024.

Official description

Combodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to a Cross-Site Request Forgery (CSRF) vulnerability. Please refer to the linked GHSA for the complete list. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-352

Which versions are affected by CVE-2024-52002?

It affects 1 product.

Products include Combodo Itop.

How do I fix CVE-2024-52002?

No fix has been published for CVE-2024-52002 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-52002 being exploited?

There is no known exploitation of CVE-2024-52002 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Combodo Itop

• CVE-2023-48710 iTop limit pages/exec.php script to PHP files Critical 9.8
• CVE-2022-39214 Authenticated users of Combodo iTop can take over any account Critical 9.6
• CVE-2021-41161 XSS in csvimport in 3.0.0-beta versions Critical 9.3
• CVE-2021-41162 Cross-site Scripting in Combodo iTop Critical 9.3
• CVE-2025-47773 Combodo iTop has XSS vulnerability in /pages/ajax.render.php High 8.8

All Combodo Itop vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xr4x-xq7v-7gqm.