Cross-site Scripting Vulnerability in Combodo iTop Service Management Tool
CVE-2024-51994

5.4MEDIUM

Key Information:

Vendor

Combodo

Status
iTop
Vendor
CVE Published:
7 November 2024

What is CVE-2024-51994?

The Combodo iTop IT Service Management tool is susceptible to a Cross-site Scripting (XSS) vulnerability when a user uploads a text file containing JavaScript within the portal. This can potentially enable attackers to execute malicious scripts in the context of user sessions. The vulnerability has been addressed in version 3.2.0, and it is crucial for users to upgrade to this version to mitigate the risk, as no known workarounds exist.

References

https://github.com/Combodo/iTop/security/advisories/GHSA-...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.