CVE-2024-51739 - CVE House
Back to Database
Status published High CVE-2024-51739

Users enumeration allowed through Rest API in Combodo iTop

Vulnerability Description

Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a valid account. As a fix the sentence displayed after resetting password no longer shows if the user exists or not. This fix is included in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. Users unable to upgrade may overload the dictionary entry `"UI:ResetPwd-Error-WrongLogin"` through an extension and replace it with a generic message.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-51739

Credits & Attribution

No credits recorded in the NVD database.

References

More from Combodo

View All →
CVE-2025-64167
Combodo iTop vulnerable to reflected XSS in webservices/export.php
High 7.1
CVE-2025-49145
iTop admin can drop iTop database using webhooks
High 8.7
CVE-2025-48878
Combodo iTop vulnerable to IDOR with ModuleInstallation object
Medium 4.3
CVE-2025-48065
Combodo iTop vulnerable to reflected XSS via objection edition form error
High 8.8
CVE-2025-48055
Combodo iTop has stored XSS in user portal's browse brick
High 8.5

Affected Vendor

Affected Software

iTop
Vulnerable Versions:
< 2.7.11, >= 3.0.0, < 3.0.5, >= 3.0.0, < 3.1.2

Timeline

Official Publish: November 5th, 2024
Last Modified: November 5th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration