Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2025-49145

iTop admin can drop iTop database using webhooks

Description

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks (mostly administrators) can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Combodo iTop

  • < 2.7.13affected
  • >= 3.0.0-alpha, < 3.2.2affected

References