A cross-site scripting vulnerability in Combodo iTop allows authenticated users with low privileges to execute arbitrary scripts in the browsers of other users, potentially leading to account takeover.

The application is susceptible to CWE-79, or Improper Neutralization of Input During Web Page Generation. This cross-site scripting flaw occurs because the application fails to properly sanitize user-supplied input before rendering it in the interface.

An attacker can leverage this vulnerability to steal session cookies, perform unauthorized actions on behalf of other users, or redirect users to malicious websites. With a CVSS score of 8.0, the potential for total impact on confidentiality, integrity, and availability within the user session context is significant, particularly in an IT service management tool containing sensitive data.

Immediate Action: Upgrade iTop to version 3.2.3 or later to ensure proper input sanitization is implemented.

Proactive Monitoring: Monitor for unusual script injection patterns in application logs or reports of unexpected browser behavior from administrative users.

Compensating Controls: Deploy a Web Application Firewall (WAF) with active XSS filtering rules to inspect incoming traffic and block payloads targeting the vulnerable input fields.

Public Exploit Available: No (no confirmed public exploit exists in available data).

Security teams should prioritize the update to version 3.2.3 to neutralize this XSS vector. Given the nature of iTop as a central IT management platform, unauthorized script execution could facilitate broader access to sensitive organizational infrastructure.