Description

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-21T20:16:34.017Z",
  "pubdate": "2026-08-21T20:16:34.017Z",
  "executiveSummary": "An information disclosure vulnerability has been identified in Combodo iTop prior to version 3.2.3. The security flaw stems from the inclusion of the complete application version string within the HTML title attribute of the logo element rendered on the public-facing login page. This design flaw introduces a risk to the confidentiality posture of the system by exposing precise software metadata to unauthenticated external actors.\nThe primary impact of this vulnerability is software fingerprinting and reconnaissance enablement. Threat actors, including automated scanners and targeted attackers, can harvest the exposed version details to map out the exact software build deployed on the target infrastructure. With precise version intelligence, an adversary can cross-reference public vulnerability databases, such as CVE repositories, to identify known security defects, missing patches, or exploit primitives specifically applicable to the running instance of Combodo iTop. This significantly lowers the barrier for subsequent, targeted exploitation phases.\nThe affected product is Combodo iTop for all software iterations prior to version 3.2.3. Exploitation of this issue requires zero privileges, no authentication credentials, and network accessibility to the authentication portal. The attacker capability is passive observation, requiring only standard HTTP request handling or DOM parsing of the login interface to extract the sensitive version metadata.",
  "technicalDetails": "The root cause of the vulnerability resides in the insecure generation of HyperText Markup Language (HTML) templates responsible for rendering the login interface within Combodo iTop. Specifically, the rendering engine injects the internal application version string directly into the title attribute of the application logo DOM element without proper sanitization, abstraction, or omission on public-facing authentication endpoints.\nThe vulnerable component is the user interface template handling the login page elements, specifically the graphical logo asset container. In versions prior to 3.2.3, parsing the raw HTML response or inspecting the Document Object Model (DOM) of the login page reveals the precise internal version identifier populated inside the title attribute. This occurs due to overly verbose error-handling or diagnostic design patterns that prioritize administrative visibility over defense-in-depth principles on pre-authentication interfaces.\nThe attack flow proceeds as follows: First, an unauthenticated network adversary sends a standard HTTP GET request to the Combodo iTop login portal endpoint. Second, the web server processes the request and returns the HTML payload for the authentication page. Third, the client-side browser or an automated reconnaissance script parses the received HTML document. Fourth, the parser extracts the version string exposed within the logo's HTML title attribute. No complex payloads, memory corruption primitives, or bypass techniques are required to trigger or extract this information.\nThe network exposure of this vulnerability is external, as the login page is intentionally accessible over the network to allow legitimate users to authenticate. The authentication requirement is none, and the privilege requirement is none. The post-exploitation impact is strictly informational from the perspective of this specific vulnerability, but it acts as a critical precursor for multi-stage attacks. Adversaries leverage the extracted version information to conduct accurate vulnerability matching, determining whether the target system is susceptible to remote code execution, SQL injection, authentication bypasses, or other historical flaws documented for that specific release of Combodo iTop."
}