PT-2024-35087 · Comodo+1 · Itop+1

Bengrenoble · Published 2024-11-08 · Updated 2025-03-14 · CVE-2024-52000

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 3.2.0

Description The issue is a reflected Cross-site Scripting (XSS) exploit that occurs when editing a request's payload, leading to malicious javascript execution. This has been addressed in version 3.2.0 via systematic escaping of error messages when rendering on the page.

Recommendations For versions prior to 3.2.0, upgrade to version 3.2.0 to patch the vulnerability. As a temporary workaround, consider restricting access to the editing functionality of requests until the upgrade is applied. There are no known workarounds for this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2025-4212

CVE-2024-52000

GHSA-R58G-P5R9-8HFG

Affected Products

Alt Linux

Itop

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52000.json · Exploit
• https://github.com/Combodo/iTop/security/advisories/GHSA-r58g-p5r9-8hfg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52000 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52000 · Vendor Advisory
• https://t.me/cvenotify/101151 · Telegram Post
• https://t.me/cvedetector/10249 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1855118462491771303 · Twitter Post
• https://twitter.com/CVEnew/status/1855020308572356773 · Twitter Post
• https://twitter.com/Hossted_OSS/status/1858395815447757253 · Twitter Post