Combodo iTop versions prior to 2.7.13 and 3.2.2 are susceptible to a reflected cross-site scripting vulnerability that could lead to unauthorized script execution in the context of a user session.

The software fails to properly neutralize input within a URL parameter, facilitating a cross-site scripting (CWE-79) attack. Based on the CVSS vector (PR:N), this vulnerability is exploitable by an unauthenticated attacker who can entice a user to click a malicious link.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, unauthorized actions performed on behalf of the user, or the theft of sensitive information. With a CVSS score of 7.1, this represents a high-severity risk to the integrity and confidentiality of the IT service management environment.

Immediate Action: Update iTop to version 2.7.13, 3.2.2, or later, which migrates the functionality to the secure export-v2.php script.

Proactive Monitoring: Review web access logs for suspicious URL parameters containing script tags or encoded characters that may indicate attempted injection attacks.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict rulesets to filter and block malicious scripts or unexpected characters in URL query parameters.

Public Exploit Available: No confirmed public exploit available.

The severity of this cross-site scripting vulnerability necessitates prompt action to prevent potential session compromise. Administrators should prioritize upgrading to the patched versions of iTop immediately to remove the vulnerable code path and ensure the security of their management platform.