Description

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-21T21:16:56.970Z",
  "pubdate": "2026-08-21T21:16:56.970Z",
  "executiveSummary": "An input sanitization and output encoding vulnerability exists within the dashboard save functionality of Combodo iTop prior to version 3.2.3. This security flaw manifests as a Reflected Cross-Site Scripting (XSS) vulnerability. The software fails to properly neutralize user-supplied input before rendering it back to the user within the context of the web application.\nThe primary impact of this vulnerability involves the execution of arbitrary client-side scripts, such as malicious JavaScript, within the security context of a victim's browser session. An attacker capable of exploiting this flaw can potentially hijack user sessions, access sensitive information visible to the user, or manipulate the interface of the affected application.\nThe vulnerability affects Combodo iTop versions prior to 3.2.3. The risk implications are moderate to high depending on user interaction and privileges, as successful exploitation requires an attacker to induce a victim to interact with a crafted request or URL targeting the vulnerable dashboard save functionality.\nMitigation requires upgrading the Combodo iTop deployment to version 3.2.3 or later, where the vendor has implemented the official fix to resolve the improper handling of input within the dashboard feature.",
  "technicalDetails": "The root cause of this vulnerability is the absence of adequate input validation and contextual output encoding within the dashboard save mechanism of Combodo iTop. When users submit data to be processed and saved by the dashboard functionality, the application inadequately sanitizes the parameters before reflecting them back in the HTTP response.\nThe vulnerable component is the dashboard save functionality within the web-based IT service management interface of Combodo iTop. Affected software versions include all deployments prior to 3.2.3. The vulnerability is accessible over the network via standard HTTP/HTTPS protocols.\nExploitation of this Reflected XSS vulnerability typically requires an attacker to craft a malicious URL or payload containing arbitrary JavaScript and deliver it to a target user. When the victim triggers the crafted request, the web application processes the input during the dashboard save operation and reflects the malicious payload back within the HTTP response without proper HTML or JavaScript encoding.\nOnce the victim's browser parses the HTTP response containing the unencoded payload, the script executes within the security context of the user's current session. This behavior allows the attacker to execute arbitrary script code in the browser of the victim, potentially leading to session token theft, credential harvesting through DOM manipulation, or unauthorized actions performed on behalf of the authenticated user within the iTop environment."
}