{"api_version":"1","generated_at":"2026-07-24T20:02:23+00:00","cve":"CVE-2019-19821","urls":{"html":"https://cve.report/CVE-2019-19821","api":"https://cve.report/api/cve/CVE-2019-19821.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-19821","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-19821"},"summary":{"title":"CVE-2019-19821","description":"A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify information with administrative privileges by not following the HTTP Location header in server responses. This is fixed in all iTop packages (community, essential, professional) in versions : 2.5.4, 2.6.3, 2.7.0","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2020-03-16 18:15:00","updated_at":"2020-08-24 17:37:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"https://www.pentagrid.ch/de/blog/security_issues_in_teampasswordmanager_and_combodo_itop/","name":"https://www.pentagrid.ch/de/blog/security_issues_in_teampasswordmanager_and_combodo_itop/","refsource":"MISC","tags":["Third Party Advisory"],"title":"Security issues in TeamPasswordManager and Combodo iTop (CVE-2019-19461, CVE-2019-19821) | Pentagrid AG","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.combodo.com/itop-193","name":"https://www.combodo.com/itop-193","refsource":"MISC","tags":["Product","Vendor Advisory"],"title":"iTop: open source ITIL ITSM Software","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/Combodo/iTop/security/advisories/GHSA-2gfp-2qvh-9796","name":"https://github.com/Combodo/iTop/security/advisories/GHSA-2gfp-2qvh-9796","refsource":"MISC","tags":[],"title":"Authorization bypass through backend to portal redirection · Advisory · Combodo/iTop · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19821","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19821","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"19821","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"combodo","cpe5":"itop","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"19821","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"combodo","cpe5":"itop","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2019-19821","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify information with administrative privileges by not following the HTTP Location header in server responses. This is fixed in all iTop packages (community, essential, professional) in versions : 2.5.4, 2.6.3, 2.7.0"}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://www.combodo.com/itop-193","refsource":"MISC","name":"https://www.combodo.com/itop-193"},{"refsource":"MISC","name":"https://www.pentagrid.ch/de/blog/security_issues_in_teampasswordmanager_and_combodo_itop/","url":"https://www.pentagrid.ch/de/blog/security_issues_in_teampasswordmanager_and_combodo_itop/"},{"refsource":"MISC","name":"https://github.com/Combodo/iTop/security/advisories/GHSA-2gfp-2qvh-9796","url":"https://github.com/Combodo/iTop/security/advisories/GHSA-2gfp-2qvh-9796"}]}},"nvd":{"publishedDate":"2020-03-16 18:15:00","lastModifiedDate":"2020-08-24 17:37:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":5.5},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*","versionEndExcluding":"2.7","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"19821","Ordinal":"163317","Title":"CVE-2019-19821","CVE":"CVE-2019-19821","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"19821","Ordinal":"1","NoteData":"A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify information with administrative privileges by not following the HTTP Location header in server responses. This is fixed in all iTop packages (community, essential, professional) in versions : 2.5.4, 2.6.3, 2.7.0","Type":"Description","Title":null},{"CveYear":"2019","CveId":"19821","Ordinal":"2","NoteData":"2020-03-16","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"19821","Ordinal":"3","NoteData":"2020-04-02","Type":"Other","Title":"Modified"}]}}}