CVE-2025-49145

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-11-10

Last updated on: 2025-11-21

Assigner: GitHub, Inc.

Description

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks (mostly administrators) can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-10

Last Modified

2025-11-21

Generated

2026-07-06

AI Q&A

2025-11-11

EPSS Evaluated

2026-07-05

NVD

CVE-2025-49145

EUVD

EUVD-2025-50822

Affected Vendors & Products

Vendor	Product	Version / Range
combodo	itop	to 2.7.13 (exc)
combodo	itop	From 3.0.0 (inc) to 3.2.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Combodo iTop versions prior to 2.7.13 and 3.2.2, where a user with sufficient rights to create webhooks (mostly administrators) can exploit the system to drop the database. The issue is due to lack of verification of the webhook callback signature, which was fixed in versions 2.7.13 and 3.2.2 by adding this verification.

Impact Analysis

An attacker with administrative rights who can create webhooks could exploit this vulnerability to drop the entire database, leading to loss of data and service disruption. This can cause significant operational impact and data unavailability.

Mitigation Strategies

Upgrade Combodo iTop to version 2.7.13 or 3.2.2 or later, where the vulnerability is fixed by verifying callback signatures to prevent unauthorized database drops.

Hi! I’m here to help you understand CVE-2025-49145. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70