High
Code Injection in Combodo iTop
Type: advisorySources: OSV
Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2022-24780
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 07:08 UTC · Revision 1
Source evidence
Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.
osv:CVE-2022-24780
Complete source record
{
"id": "d667b4425f8e202fc908a8123c3edfd1ca0b531bfb014cecf8d472a5fd250847",
"url": "https://osv.dev/vulnerability/CVE-2022-24780",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Code Injection in Combodo iTop",
"summary": "Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.",
"evidence": "osv:CVE-2022-24780",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2022-24780",
"aliases": [
"CVE-2022-24780",
"GHSA-v97m-wgxq-rh54"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/combodo/itop",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "b190d0e385c3d9a0e447004e9a87a2863e508403"
},
{
"introduced": "fc24746862778d60fd135c076aa1d621a723f965"
},
{
"fixed": "93f273a28778e5da8e51096f021d2dc1adbf4ef3"
},
{
"fixed": "b6fac4b411b8d145fc30fa35c66b51243eafd06b"
},
{
"fixed": "eb2a615bd28100442c7f6171707bb40884af2305"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.7.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:combodo:itop:3.0.0:alpha:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-alpha"
},
{
"last_affected": "3.0.0-alpha"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:combodo:itop:3.0.0:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-beta"
},
{
"last_affected": "3.0.0-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:combodo:itop:3.0.0:beta2:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-beta2"
},
{
"last_affected": "3.0.0-beta2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:combodo:itop:3.0.0:beta3:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-beta3"
},
{
"last_affected": "3.0.0-beta3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:combodo:itop:3.0.0:beta4:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-beta4"
},
{
"last_affected": "3.0.0-beta4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:combodo:itop:3.0.0:beta5:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-beta5"
},
{
"last_affected": "3.0.0-beta5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:combodo:itop:3.0.0:beta6:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-beta6"
},
{
"last_affected": "3.0.0-beta6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:combodo:itop:3.0.0:beta7:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-beta7"
},
{
"last_affected": "3.0.0-beta7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:combodo:itop:3.0.0:beta8:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-beta8"
},
{
"last_affected": "3.0.0-beta8"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:combodo:itop:3.0.0:rc:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-rc"
},
{
"last_affected": "3.0.0-rc"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "93f273a28778e5da8e51096f021d2dc1adbf4ef3"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "b6fac4b411b8d145fc30fa35c66b51243eafd06b"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "eb2a615bd28100442c7f6171707bb40884af2305"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"3.0.0-alpha",
"3.0.0-beta",
"3.0.0-beta2",
"3.0.0-beta3",
"3.0.0-beta4",
"3.0.0-beta5",
"3.0.0-beta6",
"3.0.0-beta7",
"3.0.0-beta8",
"3.0.0-rc",
"2.7.5",
"2.7.4",
"2.7.3",
"1.0.8",
"2.7.2",
"2.7.1",
"2.6.3",
"2.6.2",
"2.6.1",
"N941-2",
"N941",
"N2016",
"N2011",
"N1963"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24780.json"
}
}
],
"modified": "2026-10-28T02:30:26.858432091Z",
"provider": "osv",
"references": [
"https://markus-krell.de/itop-template-injection-inside-customer-portal/",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24780.json",
"https://github.com/Combodo/iTop/security/advisories/GHSA-v97m-wgxq-rh54",
"https://nvd.nist.gov/vuln/detail/CVE-2022-24780",
"https://github.com/Combodo/iTop/commit/93f273a28778e5da8e51096f021d2dc1adbf4ef3",
"https://github.com/Combodo/iTop/commit/b6fac4b411b8d145fc30fa35c66b51243eafd06b",
"https://github.com/Combodo/iTop/commit/eb2a615bd28100442c7f6171707bb40884af2305"
],
"provider_metadata": {
"cwe_ids": [
"CWE-94"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24780.json"
}
},
"related_cves": [
{
"value": "CVE-2022-24780",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 493246,
"published_at": "2022-04-05T18:30:18+00:00"
}