CVE-2011-4275: XSS
Multiple cross-site scripting (XSS) vulnerabilities in iTop (aka IT Operations Portal) 1.1.181 and 1.2.0-RC-282 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted company name, (2) a crafted database server name, (3) a crafted CSV file, (4) a crafted copy-and-paste action, (5) the authuser parameter in a suggestpwd action to UI.php, (6) the c[menu] parameter to UniversalSearch.php, (7) the description parameter in a SearchFormToAdddocumentlist action to UI.php, (8) the category parameter in an errors action to audit.php, or (9) the suggestpwd parameter to UI.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4275?
CVE-2011-4275 is classified as a moderate severity vulnerability due to the potential for cross-site scripting attacks.
How do I fix CVE-2011-4275?
To fix CVE-2011-4275, upgrade to a version of iTop that is not vulnerable, specifically any version released after 1.2.0-RC-282.
What types of inputs are exploited in CVE-2011-4275?
CVE-2011-4275 can be exploited through crafted company names, database server names, CSV files, and other user inputs.
Who is affected by CVE-2011-4275?
CVE-2011-4275 affects users of iTop version 1.1.181 and 1.2.0-RC-282.
What can an attacker achieve by exploiting CVE-2011-4275?
An attacker exploiting CVE-2011-4275 can inject arbitrary web script or HTML, potentially compromising user data and application integrity.