CVE-2023-34444

Cross-site Scripting vulnerability on pages/ajax.searchform.php in Combodo iTop

CVSS 8.8 HIGHEPSS 0.3%CWE-79

Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.searchform.php XSS are possible for scripts outside of script tags. This issue has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Produtos afetados

Combodo · iTop

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/Combodo/iTop/security/advisories/GHSA-rwx9-rcxf-qrwv