PT-2025-46182 · Comodo+1 · Itop+1

Publicado 2025-04-23 · Atualizado 2026-02-24 · CVE-2025-47286

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 2.7.13 Combodo iTop versions prior to 3.2.2

Description Combodo iTop is a web-based IT service management tool. An administrator can execute code on the server by editing the configuration of the iTop instance in affected versions. Versions 2.7.13 and 3.2.2 include measures to escape and check the configuration parameter before executing a command based on it.

Recommendations Update to version 2.7.13 or later. Update to version 3.2.2 or later.

Exploit

Correção

Special Elements Injection

OS Command Injection

Enumeração de Fraquezas

CWE-74

CWE-78

Identificadores relacionados

BDU:2025-06926

CVE-2025-47286

GHSA-4W93-RW6G-5M9C

Produtos afetados

Red Os

Itop

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47286.json · Exploit
• https://github.com/Combodo/iTop/security/advisories/GHSA-4w93-rw6g-5m9c · Aviso do Fabricante
• https://github.com/Combodo/iTop/releases/tag/3.2.2 · Nota
• https://osv.dev/vulnerability/CVE-2025-47286 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2025-06926 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2025-47286 · Nota de Segurança
• https://twitter.com/CVEnew/status/1987961909656908251 · Publicação no Twitter
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-php-itop-cve-2025-47286-8.0 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-php-itop-cve-2025-47286-7.3 · Nota