CVE-2020-15221: XSS in the breadcrumbs
First published: Wed Jan 13 2021(Updated: )
Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, by modifying target browser local storage, an XSS can be generated in the iTop console breadcrumb. This is fixed in versions 2.7.2 and 3.0.0.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Combodo iTop | <2.7.2 | |
| Combodo iTop | =3.0.0-alpha |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is Combodo iTop?
Combodo iTop is a web based IT Service Management tool.
What is the vulnerability in Combodo iTop?
The vulnerability in Combodo iTop is an XSS (Cross-site Scripting) vulnerability.
What versions of Combodo iTop are affected by the vulnerability?
Versions 2.7.2 and 3.0.0-alpha of Combodo iTop are affected by the vulnerability.
How can an attacker exploit the vulnerability?
By modifying the target browser local storage, an attacker can generate an XSS in the iTop console breadcrumb.
Has the vulnerability been fixed?
Yes, the vulnerability has been fixed in versions 2.7.2 and 3.0.0 of Combodo iTop.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/author
- agent/severity
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- vendor/combodo
- canonical/combodo itop
- version/combodo itop/3.0.0-alpha