Combodo iTop Cross-Site Scripting Vulnerability in Dashboard AJAX Editing

A cross-site scripting (XSS) vulnerability has been identified in Combodo iTop, a web-based IT service management tool. This issue affects versions prior to 2.7.13 and 3.2.2. The vulnerability arises when a dashboard is edited through an AJAX call, allowing for the injection of malicious scripts. In contrast, versions 2.7.13 and 3.2.2 have implemented measures to protect rendered HTML content from such attacks.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.