PT-2024-24348 · Comodo+1 · Combodo Itop+1

Viliald · Published 2024-11-04 · Updated 2025-03-14 · CVE-2024-31998

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 3.1.2 Combodo iTop versions prior to 3.2.0

Description A CSRF issue can be performed on CSV import simulation in Combodo iTop, allowing an attacker to forge malicious requests. There are no known workarounds for this issue.

Recommendations For Combodo iTop versions prior to 3.1.2, upgrade to version 3.1.2 or later to resolve the issue. For Combodo iTop versions prior to 3.2.0, upgrade to version 3.2.0 or later to resolve the issue.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

ALT-PU-2025-4212

CVE-2024-31998

GHSA-8CWX-Q4XH-7C7R

Affected Products

Alt Linux

Combodo Itop

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31998.json · Exploit
• https://github.com/Combodo/iTop/security/advisories/GHSA-8cwx-q4xh-7c7r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-31998 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31998 · Security Note
• https://twitter.com/CVEnew/status/1853585860505088084 · Twitter Post
• https://twitter.com/CveFindCom/status/1853588213991903596 · Twitter Post
• https://twitter.com/UndercodeNews/status/1854215115656048749 · Twitter Post
• https://t.me/cvenotify/100605 · Telegram Post
• https://t.me/latest_high_impact_cve/1451 · Telegram Post
• https://t.me/cvenotify/100793 · Telegram Post
• https://t.me/cvedetector/9802 · Telegram Post
• https://twitter.com/oktsec/status/1853657919750852929 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1853674083486945448 · Twitter Post