VulnerabilityAnalyzed
CVE-2023-44396
Dashlet edits ajax endpoints can be used to produce XSS.
MEDIUM 5.4EPSS 0.42%
Does this matter?
Lower severity and a low EPSS score (0.42%). Track it; it rarely justifies an emergency change on its own.
Description
iTop is an IT service management platform. Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.42% probability · 35th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79, CWE-80
- Affected
- combodo/itop
- Source
- security-advisories@github.com
References
- https://github.com/Combodo/iTop/commit/9df92665e08c4bf5d4d8a5a9fe21fd3fb26fb273Patch
- https://github.com/Combodo/iTop/commit/c72cb7e70ebf469ce0ec01f5f9b524e39afe6c7fPatch
- https://github.com/Combodo/iTop/security/advisories/GHSA-gqqj-jgh6-3x35Vendor Advisory
- https://github.com/Combodo/iTop/commit/9df92665e08c4bf5d4d8a5a9fe21fd3fb26fb273Patch
- https://github.com/Combodo/iTop/commit/c72cb7e70ebf469ce0ec01f5f9b524e39afe6c7fPatch
- https://github.com/Combodo/iTop/security/advisories/GHSA-gqqj-jgh6-3x35Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.