Cross-Site Scripting Vulnerability in Combodo iTop IT Service Management Tool
CVE-2025-47932
8.8HIGH
What is CVE-2025-47932?
The Combodo iTop IT service management tool is susceptible to cross-site scripting (XSS) attacks when dashboards are rendered via AJAX calls in versions prior to 2.7.13 and 3.2.2. Attackers can exploit this vulnerability to inject malicious scripts, potentially compromising user data and system integrity. The issue is resolved in version 2.7.13 and 3.2.2, where proper sanitization mechanisms have been implemented to mitigate XSS risks.
Affected Version(s)
iTop < 2.7.13 < 2.7.13
iTop >= 3.0.0-alpha, < 3.2.2 < 3.0.0-alpha, 3.2.2