Combodo iTop Cross-Site Scripting Vulnerability in Export Functionality

A cross-site scripting (XSS) vulnerability has been identified in Combodo iTop versions prior to 2.7.13 and 3.2.1. This issue allows for JavaScript execution when the URL parameter is edited, specifically in the webservices/export.php file, which is deprecated in the newer versions. The vulnerability arises from reflected XSS, where user input is not properly sanitized before being outputted.

Impact

Exploitation of this vulnerability allows for cross-site scripting attacks, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users are advised to update to iTop versions 2.7.13 or 3.2.2, and to avoid using export.php, which will be removed in version 3.3. Instead, use export-v2.php.