CVE-2024-51994: Combodo Itop

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Combodo iTop is a web based IT Service Management tool. In affected versions uploading a text file containing some java script in the portal will trigger an Cross-site Scripting (XSS) vulnerability. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

• Combodo Itop: before 2.7.11 (fixed in 2.7.11); from 3.0.0, before 3.1.2 (fixed in 3.1.2)

Published 2024-11-07. Last modified 2026-06-17.