CVE-2025-48878 — AI Deep Analysis Summary

🚨 **Insecure Direct Object Reference (IDOR)** in Combodo iTop. Allows unauthorized creation of `ModuleInstallation` objects.…

🔍 **CWE-918**: Insecure Direct Object Reference. The app exposes internal object references (like ModuleInstallation) without proper authorization checks. 🛑 Flaw: No validation of user permissions before object creation.

⚠️ **Affected**: Combodo iTop versions **before 3.2.2**. 📦 Component: Web application core handling module installations. 🌐 All deployments using vulnerable versions are at risk.

🔓 Hackers with **low privileges** (PR:L) can create `ModuleInstallation` objects. 🧩 No direct data theft (C:N), but can **alter application behavior** (I:L) — e.g., inject malicious modules or bypass controls.

📉 **Low exploitation threshold**. 🧑‍💻 Requires only low privileges (PR:L). No user interaction needed (UI:N). Exploitable remotely (AV:N). 🎯 Easy to automate.

❌ **No public PoC** listed. 📌 References only point to official advisory (GHSA-rj75-7cgw-4556). 🚫 No evidence of wild exploitation reported.

🔍 **Self-check**: Audit for `ModuleInstallation` creation endpoints. 🧪 Use tools like Burp Suite to test if low-privilege users can create modules. 📊 Check logs for unexpected module installs.

✅ **Officially fixed in v3.2.2**. 🛡️ Patch includes access control enforcement for ModuleInstallation. 📦 Upgrade to 3.2.2 or later to resolve.

🛠️ **Workaround**: Disable module installation feature if not needed. 🔐 Implement custom access control via iTop extensions. 📋 Monitor for unauthorized module creation logs.

⚠️ **Medium urgency**. CVSS 3.1: 5.3 (L:Low, I:Low, C:None). 🚨 Not critical, but **should be patched promptly** to prevent service disruption or privilege creep. 📅 Prioritize if module management is active.