CVE-2025-24785

{"id": "CVE-2025-24785", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2025-05-14T15:15:56.983", "references": [{"url": "https://github.com/Combodo/iTop/security/advisories/GHSA-49rq-cgv9-7hv4", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "iTop is an web based IT Service Management tool. In version 3.2.0, an attacker may send a URL to the server to trigger a PHP error. The next user trying to load this dashboard would encounter a crashed start page. Version 3.2.1 fixes the issue by checking the provided layout_class before saving the dashboard."}, {"lang": "es", "value": "iTop es una herramienta web de gesti\u00f3n de servicios de TI. En la versi\u00f3n 3.2.0, un atacante pod\u00eda enviar una URL al servidor para generar un error de PHP. El siguiente usuario que intentara cargar este panel se encontrar\u00eda con una p\u00e1gina de inicio bloqueada. La versi\u00f3n 3.2.1 corrige el problema comprobando la clase layout_class antes de guardar el panel. "}], "lastModified": "2025-08-01T18:38:35.280", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6BE41CA6-35B8-41BA-B116-B63136CA48C9", "versionEndExcluding": "3.2.1", "versionStartIncluding": "3.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}