No CSRF form token cleanup on Windows servers
Priority LOW 38CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.
Summary
Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Windows servers no cleanup is done on CSRF tokens. This issue is fixed in versions 2.7.4 and 3.0.0.
Why it matters now
EPSS 0.00377 31st percentileScored 2026-11-07
Fix Fixed iTop (Combodo): 2.7.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Combodo | iTop | before 2.7.4 | 2.7.4 | Patch available | CNA |
- iTop VendorCombodo Affected before 2.7.4 Fixed in 2.7.4 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:* | before 2.7.4 | Vulnerable | Combodo |
| cpe:2.3:a:combodo:itop:3.0.0:alpha:*:*:*:*:*:* | 3.0.0 alpha | Vulnerable | Combodo |
| cpe:2.3:a:combodo:itop:3.0.0:beta:*:*:*:*:*:* | 3.0.0 beta | Vulnerable | Combodo |
| cpe:2.3:a:combodo:itop:3.0.0:beta2:*:*:*:*:*:* | 3.0.0 beta2 | Vulnerable | Combodo |
- cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:* Versions before 2.7.4 Vulnerable ·Combodo
- cpe:2.3:a:combodo:itop:3.0.0:alpha:*:*:*:*:*:* Versions 3.0.0 alpha Vulnerable ·Combodo
- cpe:2.3:a:combodo:itop:3.0.0:beta:*:*:*:*:*:* Versions 3.0.0 beta Vulnerable ·Combodo
- cpe:2.3:a:combodo:itop:3.0.0:beta2:*:*:*:*:*:* Versions 3.0.0 beta2 Vulnerable ·Combodo
Remediation
- Fix · CNA iTop (Combodo) Fixed in 2.7.4
Timeline
- 2026-10-02 Threatist record created from CVE-2021-32776
References
More Combodo Itop vulnerabilities
- TI-2022-08681 Stored Cross-site Scripting in Combodo iTop CVSS 3.1HIGH 8.7
- TI-2022-08593 Code Injection in Combodo iTop CVSS 3.1HIGH 8.8
- TI-2021-18080 Possible Cross-Site Request Forgery in Combodo iTop CVSS 3.1HIGH 8.1
- TI-2023-25672 Cross Site Scripting vulnerability in Combodo iTop v.3.1.0-2-11973 allows a local… CVSS 3.1MEDIUM 6.1
- TI-2022-18593 Authenticated users of Combodo iTop can take over any account CVSS 3.1CRITICAL 9.6
- TI-2022-08624 Cross-site Scripting in Combodo iTop CVSS 3.1MEDIUM 5.4
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences