CVE-2025-49145
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-10

Last updated on: 2025-11-21

Assigner: GitHub, Inc.

Description
Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks (mostly administrators) can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-10
Last Modified
2025-11-21
Generated
2026-06-16
AI Q&A
2025-11-11
EPSS Evaluated
2026-06-15
NVD
CVE-2025-49145
EUVD
EUVD-2025-50822
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
combodo itop to 2.7.13 (exc)
combodo itop From 3.0.0 (inc) to 3.2.2 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Combodo iTop versions prior to 2.7.13 and 3.2.2, where a user with sufficient rights to create webhooks (mostly administrators) can exploit the system to drop the database. The issue is due to lack of verification of the webhook callback signature, which was fixed in versions 2.7.13 and 3.2.2 by adding this verification.

Impact Analysis

An attacker with administrative rights who can create webhooks could exploit this vulnerability to drop the entire database, leading to loss of data and service disruption. This can cause significant operational impact and data unavailability.

Mitigation Strategies

Upgrade Combodo iTop to version 2.7.13 or 3.2.2 or later, where the vulnerability is fixed by verifying callback signatures to prevent unauthorized database drops.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-49145. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart