iTop Cross-Site Scripting Vulnerability in CSV Import

A cross-site scripting (XSS) vulnerability has been identified in iTop, a web-based IT Service Management tool, prior to versions 3.1.3 and 3.2.1. The issue arises when malicious code is inserted into a CSV file and then imported, allowing the script to execute. This vulnerability has been addressed in versions 3.1.3 and 3.2.1. Users are advised to inspect CSV content for harmful code before importing.

Impact

Exploitation of this vulnerability allows for cross-site scripting attacks, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can update to iTop versions 3.1.3 or 3.2.1 to address this vulnerability. As an additional step, it is recommended to check CSV content for malicious code before importing.