Vulnerability · Published Oct 19, 2021 · Assigned by GitHub_M
CVE-2021-32664Reflected XSS in Combodo/iTop
High 8.1
In plain English
A high-severity cross-site scripting in iTop from Combodo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.8%top 42.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
References
- https://github.com/Combodo/iTop/security/advisories/GHSA-j758-ggwg-9mpj x_refsource_CONFIRM
- https://github.com/Combodo/iTop/commit/4f5c987d8b1bd12814dc606ea69b6cfb88490704 x_refsource_MISC
- https://github.com/Combodo/iTop/commit/84741c19f0af6fa8e7082a8807eb089182e7b88a x_refsource_MISC
- https://github.com/Combodo/iTop/commit/86f649affc12b5078efc86d9439d67d98f4cb2f6 x_refsource_MISC