Combodo Itop vulnerabilities

CVE-2023-34447 [MEDIUM] CWE-79 CVE-2023-34447: iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, on `pages/UI.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0.

CVE-2021-41161 [MEDIUM] CWE-79 CVE-2021-41161: Combodo iTop is a web based IT Service Management tool. In versions prior to 3.0.0-beta6 the export Combodo iTop is a web based IT Service Management tool. In versions prior to 3.0.0-beta6 the export CSV page don't properly escape the user supplied parameters, allowing for javascript injection into rendered csv files. Users are advised to upgrade. There are no known workarounds for this issue.

CVE-2023-34446 [MEDIUM] CWE-79 CVE-2023-34446: iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, when displaying `pages/preferences.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0.

CVE-2024-52000 [MEDIUM] CWE-79 CVE-2024-52000: Combodo iTop is a simple, web based IT Service Management tool. Affected versions are subject to a r Combodo iTop is a simple, web based IT Service Management tool. Affected versions are subject to a reflected Cross-site Scripting (XSS) exploit by way of editing a request's payload which can lead to malicious javascript execution. This issue has been addressed in version 3.2.0 via systematic escaping of error messages when rendering on the page. All

CVE-2025-47773 [MEDIUM] CWE-79 CVE-2025-47773: Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulne Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a dashboard is edited via an AJAX call. Versions 2.7.13 and 3.2.2 protect rendered HTML content.

CVE-2023-45808 [MEDIUM] CWE-639 CVE-2023-45808: iTop is an IT service management platform. When creating or updating an object, extkey values aren' iTop is an IT service management platform. When creating or updating an object, extkey values aren't checked to be in the current user silo. In other words, by forging an http request, the user can create objects pointing to out of silo objects (for example a UserRequest in an out of scope Organization). Fixed in iTop 2.7.10, 3.0.4, 3.1.1, and 3.2.0.

CVE-2025-48055 [MEDIUM] CWE-79 CVE-2025-48055: Combodo iTop is a web based IT service management tool. In versions prior to 3.2.2, when displaying Combodo iTop is a web based IT service management tool. In versions prior to 3.2.2, when displaying content in a browse brick in the user portal, a cross-site scripting attack can occur. This is fixed in versions 3.2.2 and 3.3.0.

CVE-2020-15220 [MEDIUM] CWE-613 CVE-2020-15220: Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, two Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, two cookies are created for the same session, which leads to a possibility to steal user session. This is fixed in versions 2.7.2 and 3.0.0.

CVE-2021-41162 [MEDIUM] CWE-79 CVE-2021-41162: Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to beta6 the `a Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to beta6 the `ajax.render.php?operation=wizard_helper` page did not properly escape the user supplied parameters, allowing for a cross site scripting attack vector. Users are advised to upgrade. There are no known workarounds for this issue.

CVE-2023-47622 [MEDIUM] CWE-79 CVE-2023-47622: iTop is an IT service management platform. When dashlet are refreshed, XSS attacks are possible. T iTop is an IT service management platform. When dashlet are refreshed, XSS attacks are possible. This vulnerability is fixed in 3.0.4 and 3.1.1.

CVE-2023-47626 [MEDIUM] CWE-79 CVE-2023-47626: iTop is an IT service management platform. When displaying/editing the user's personal tokens, XSS iTop is an IT service management platform. When displaying/editing the user's personal tokens, XSS attacks are possible. This vulnerability is fixed in 3.1.1.

CVE-2024-31448 [MEDIUM] CWE-79 CVE-2024-31448: Combodo iTop is a simple, web based IT Service Management tool. By filling malicious code in a CSV c Combodo iTop is a simple, web based IT Service Management tool. By filling malicious code in a CSV content, an Cross-site Scripting (XSS) attack can be performed when importing this content. This issue has been fixed in versions 3.1.2 and 3.2.0. All users are advised to upgrade. Users unable to upgrade should validate CSV content before importing it.

CVE-2025-48065 [MEDIUM] CWE-79 CVE-2025-48065: Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulne Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a field with an error contains malicious content. Versions 2.7.13 and 3.2.2 protect rendered HTML content.

CVE-2022-24870 [MEDIUM] CWE-79 CVE-2022-24870: Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to 3.0.0 beta3 Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to 3.0.0 beta3 a malicious script can be injected in tooltips using iTop customization mechanism. This provides a stored cross site scripting attack vector to authorized users of the system. Users are advised to upgrade. There are no known workarounds for this issue.

CVE-2023-44396 [MEDIUM] CWE-79 CVE-2023-44396: iTop is an IT service management platform. Dashlet edits ajax endpoints can be used to produce XSS. iTop is an IT service management platform. Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1.

CVE-2023-43790 [MEDIUM] CWE-79 CVE-2023-43790: iTop is an IT service management platform. By manipulating HTTP queries, a user can inject maliciou iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname value. This vulnerability is fixed in 3.1.1 and 3.2.0.

CVE-2024-51994 [MEDIUM] CWE-79 CVE-2024-51994: Combodo iTop is a web based IT Service Management tool. In affected versions uploading a text file c Combodo iTop is a web based IT Service Management tool. In affected versions uploading a text file containing some java script in the portal will trigger an Cross-site Scripting (XSS) vulnerability. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE-2022-31402 [MEDIUM] CWE-79 CVE-2022-31402: ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/webservic ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/webservices/export-v2.php.

CVE-2022-31403 [MEDIUM] CWE-79 CVE-2022-31403: ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/pages/aja ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/pages/ajax.render.php.

CVE-2023-47488 [MEDIUM] CWE-79 CVE-2023-47488: Cross Site Scripting vulnerability in Combodo iTop v.3.1.0-2-11973 allows a local attacker to obtain Cross Site Scripting vulnerability in Combodo iTop v.3.1.0-2-11973 allows a local attacker to obtain sensitive information via a crafted script to the attrib_manager_id parameter in the General Information page and the id parameter in the contact page.