Combodo iTop contains a high-severity cross-site scripting vulnerability that allows authenticated attackers to compromise user sessions and perform unauthorized actions.

The vulnerability is categorized as CWE-79, indicating a failure to properly sanitize user-supplied input. It requires authentication and user interaction to execute successfully.

The ability for an attacker to execute scripts in the context of another user's session can lead to full account takeover, unauthorized modification of IT service records, or theft of sensitive configuration data. The CVSS score of 8.0 confirms that this is a critical security concern that could result in significant operational disruption.

Immediate Action: Apply the vendor-supplied patch by upgrading to iTop version 3.2.3.

Proactive Monitoring: Use web application security scanners to identify potential XSS entry points and monitor logs for suspicious JavaScript payloads.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block known malicious patterns associated with cross-site scripting attacks.

Public Exploit Available: Unknown

To mitigate the risks associated with this vulnerability, all affected systems must be updated to version 3.2.3. Failure to patch may expose the organization to session-based attacks that bypass standard authentication controls.