Combodo iTop versions prior to 3.2.3 contain a cross-site scripting vulnerability that could allow attackers to execute arbitrary scripts in the context of a user session.

This vulnerability is a Cross-Site Scripting (XSS) flaw where the application fails to properly sanitize input. An unauthenticated attacker can inject malicious scripts that execute when a victim views the affected page, leveraging the browser to perform actions on behalf of the user.

With a CVSS score of 7.1, this vulnerability represents a high risk to organizational security. Successful exploitation could result in session hijacking, unauthorized access to sensitive IT service management data, or the redirection of users to malicious websites, severely impacting operational security and user trust.

Immediate Action: Update Combodo iTop to version 3.2.3 or later to apply the necessary security patches.

Proactive Monitoring: Review web application firewall logs and system access logs for suspicious script injection patterns, such as encoded HTML tags or JavaScript keywords in input fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS filtering rules to block malicious payloads from reaching the application interface until the update is applied.

Public Exploit Available: No (exploit_available: false)

The vulnerability is addressed in version 3.2.3 of iTop. It is imperative that administrators upgrade their instances immediately to protect against potential XSS attacks that could compromise administrative or user accounts.