Description

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has been fixed in version 3.2.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-08-21T21:16:57.403Z",
  "pubdate": "2026-08-21T21:16:57.403Z",
  "executiveSummary": "A Reflected Cross-Site Scripting (XSS) vulnerability exists within the universal search functionality of Combodo iTop prior to version 3.2.3. This security flaw allows malicious actors to execute arbitrary client-side scripts, such as JavaScript, within the context of a victim's browser session.\nThe vulnerability impacts deployments of Combodo iTop running software versions earlier than 3.2.3. Successful exploitation requires an attacker to trick a user into interacting with a specially crafted URL containing malicious payloads.\nThe risk implications include potential session hijacking, unauthorized access to sensitive IT service management data, and unauthorized actions performed on behalf of the authenticated user within the web application. The attacker's capability relies on social engineering vectors to deliver the malicious input via the universal search interface, where it is improperly sanitized or encoded before being reflected back in the HTTP response.",
  "technicalDetails": "The vulnerability stems from improper input validation and output encoding within the universal search component of Combodo iTop prior to version 3.2.3. Specifically, user-supplied search parameters processed by the universal search feature are insufficiently sanitized before being returned to the user in the HTTP response body.\nThe attack vector is network-based and relies on reflected XSS mechanics. An unauthorized or low-privileged external attacker crafts a malicious URL containing JavaScript payloads injected into the search query parameter. When a targeted user clicks or navigates to the crafted URL, the browser sends the request to the vulnerable Combodo iTop server.\nThe server processes the request and reflects the unsanitized payload back to the browser within the dynamic HTML response generated by the universal search functionality. The victim's web browser interprets the reflected payload as legitimate executable script content rather than inert plain text, executing it within the security context of the application origin.\nBecause the script executes in the victim's browser session, it gains access to Document Object Model (DOM) elements, session cookies, and local storage tokens associated with the application. This facilitates post-exploitation activities such as session hijacking, defacement of the interface, or the execution of unauthorized administrative or transactional requests on behalf of the victim if sufficient privileges exist."
}