Vulnerability · Published Jan 13, 2021 · Assigned by GitHub_M
CVE-2020-15221XSS in the breadcrumbs
Medium 6.8
In plain English
A medium-severity cross-site scripting in iTop from Combodo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)0.6%top 53.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, by modifying target browser local storage, an XSS can be generated in the iTop console breadcrumb. This is fixed in versions 2.7.2 and 3.0.0.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
References
- https://github.com/Combodo/iTop/security/advisories/GHSA-w6g2-p7pf-7hvw x_refsource_CONFIRM