CVE-2019-11215: Combodo Itop

High severity, CVSS 8.1. EPSS: 1.2% chance of exploitation in the next 30 days.

In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader with a maliciously crafted payload. Many conditions can place the configuration file into a writable state: during installation; during upgrade; in certain cases, an error during modification of the file from the web interface leaves the file writable (can be triggered with XSS); a race condition can be triggered by the hub-connector module (community version only from 2.4.1 to 2.6.0); or editing the file in a CLI.

Affected products

• Combodo Itop: from 2.2.0, up to and including 2.4.0; from 2.4.1, up to and including 2.6.0

Published 2020-02-14. Last modified 2026-06-17.