CVE-2021-41162: Cross-site Scripting in Combodo iTop
Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to beta6 the ajax.render.php?operation=wizardhelper page did not properly escape the user supplied parameters, allowing for a cross site scripting attack vector. Users are advised to upgrade. There are no known workarounds for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-41162?
CVE-2021-41162 is classified as a cross-site scripting (XSS) vulnerability, which can have a high impact if exploited.
How do I fix CVE-2021-41162?
To fix CVE-2021-41162, upgrade Combodo iTop to version 3.0.0-beta6 or later.
Which versions are affected by CVE-2021-41162?
CVE-2021-41162 affects Combodo iTop versions 3.0.0 beta releases prior to beta6 and all versions up to 2.7.6.
What kind of attacks does CVE-2021-41162 allow?
CVE-2021-41162 allows attackers to perform cross-site scripting attacks by exploiting unescaped user inputs.
Is there a mitigation for CVE-2021-41162 until I can upgrade?
The primary mitigation for CVE-2021-41162 is to avoid using affected versions until an upgrade can be performed.