CVE-2019-19821 - CVE House
Back to Database
Status published High CVE-2019-19821

A post-authentication privilege escalation in the web application of Combodo...

Vulnerability Description

A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify information with administrative privileges by not following the HTTP Location header in server responses. This is fixed in all iTop packages (community, essential, professional) in versions : 2.5.4, 2.6.3, 2.7.0

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-19821

Credits & Attribution

No credits recorded in the NVD database.

References

More from combodo

View All →
CVE-2022-31403
ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS)...
Medium 6.1
CVE-2022-31402
ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS)...
Medium 6.1
CVE-2020-11697
In Combodo iTop, dashboard ids can be exploited with a...
Medium 6.1
CVE-2020-11696
In Combodo iTop a menu shortcut name can be exploited...
Medium 6.1
CVE-2019-13967
iTop 2.2.0 through 2.6.0 allows remote attackers to cause a...
High 7.5

Affected Vendor

Affected Software

itop
Vulnerable Versions:
0

Timeline

Official Publish: March 16th, 2020
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.