Description

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-21T22:16:36.863Z",
  "pubdate": "2026-08-21T22:16:36.863Z",
  "executiveSummary": "A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Combodo iTop prior to version 3.2.3, specifically residing within the foreign key search criteria API. This security flaw enables remote attackers to inject malicious JavaScript payloads via HTTP requests, which are subsequently reflected back in the application response and executed within the context of the victim's browser session. Successful exploitation of this vulnerability can lead to unauthorized actions performed on behalf of the user, session hijacking, credential theft, and manipulation of the Document Object Model (DOM) of the affected web application. The impact is contingent upon successful user interaction, typically requiring a victim to follow a maliciously crafted URL. Combodo has addressed and resolved this security issue in version 3.2.3. Organizations utilizing vulnerable deployments prior to this version face potential risk if users are targeted with crafted exploitation links against the exposed API endpoint.",
  "technicalDetails": "The vulnerability exists within the foreign key search criteria API of Combodo iTop prior to version 3.2.3, stemming from insufficient input sanitization and output encoding of user-supplied parameters. Reflected Cross-Site Scripting occurs when an application receives untrusted data in an HTTP request and includes that data within its immediate response in an unsafe manner without proper validation or contextual escaping. In this specific attack vector, an unvalidated parameter passed to the foreign key search criteria API is echoed directly back to the client-side environment. Attackers can exploit this by crafting a malicious URI containing JavaScript payloads within the vulnerable search criteria parameters and inducing an authenticated or targeted user to trigger the request via social engineering or external resource injection. Upon rendering the HTTP response, the browser interprets the reflected payload as executable script content rather than inert text data, executing it within the security context of the victim's active session. This grants the attacker the ability to interact with the iTop application API using the victim's credentials, extract sensitive session tokens, read accessible DOM elements, or perform administrative or transactional actions depending on the privilege level of the targeted user. Network exposure includes any interface capable of reaching the web-based IT service management tool's API endpoints. The root cause is addressed in version 3.2.3 through strict output encoding and input validation mechanisms implemented on the affected foreign key search criteria parameters."
}