Combodo iTop Cross-Site Scripting Vulnerability in Dashboard AJAX Rendering

A cross-site scripting vulnerability has been identified in Combodo iTop versions prior to 2.7.13 and 3.2.2. The issue arises when a dashboard is rendered through an AJAX call, allowing for the injection of malicious scripts. In contrast, versions 2.7.13 and 3.2.2 have implemented proper sanitization to mitigate this risk.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.