Combodo iTop is a simple, web based IT Service Management tool. Affected versions are subject to a reflected Cross-site Scripting (XSS) exploit by way of editing a request's payload which can lead to malicious javascript execution. This issue has been addressed in version 3.2.0 via systematic escaping of error messages when rendering on the page. All users are advised to upgrade. There are no known workarounds for this vulnerability.
References
| Link | Resource |
|---|---|
| https://github.com/Combodo/iTop/security/advisories/GHSA-r58g-p5r9-8hfg | Vendor Advisory |
Configurations
History
07 Jan 2025, 16:52
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| First Time |
Combodo itop
Combodo |
|
| CWE | CWE-79 | |
| References | () https://github.com/Combodo/iTop/security/advisories/GHSA-r58g-p5r9-8hfg - Vendor Advisory | |
| CPE | cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:* |
08 Nov 2024, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-08 23:15
Updated : 2025-01-07 16:52
NVD link : CVE-2024-52000
Mitre link : CVE-2024-52000
JSON object : View
Products Affected
combodo
- itop
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')