CVE-2023-44396: iTop vulnerable to XSS in dashlet modifications ajax endpoints
Published Apr 15, 2024
·Updated
iTop is an IT service management platform. Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1.
Affected Software
4 affected components
iTop iTop<2.7.10, <3.0.4, <3.1.1
Combodo iTop<2.7.1
Combodo iTop>=3.0.0<3.0.4
Combodo iTop>=3.1.0<3.1.1
Remediation
Event History
Apr 15, 2024
CVE Published
via MITRE·05:13 PM
Data Sourced
via MITRE·05:13 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2023-44396?
CVE-2023-44396 is classified as a Cross-Site Scripting (XSS) vulnerability.
2
How do I fix CVE-2023-44396?
To remediate CVE-2023-44396, update iTop to version 2.7.10, 3.0.4, or 3.1.1.
3
Which versions of iTop are affected by CVE-2023-44396?
Versions of iTop prior to 2.7.10, 3.0.4, and 3.1.1 are affected by CVE-2023-44396.
4
What can an attacker do by exploiting CVE-2023-44396?
An attacker exploiting CVE-2023-44396 can execute arbitrary JavaScript code in the context of a user's browser session.
5
Is there a workaround for CVE-2023-44396 if I can't update?
Currently, there is no official workaround for CVE-2023-44396; updating to a fixed version is recommended.