CVE-2024-56157 — iTop vulnerable to Self XSS in CSV Import

CVE-2024-56157

iTop vulnerable to Self XSS in CSV Import PUBLISHED

Description (CNA)

iTop is an web based IT Service Management tool. Prior to versions 3.1.3 and 3.2.1, by filling malicious code in a CSV content, a cross-site scripting attack can be performed when importing this content. The issue is fixed in versions 3.1.3 and 3.2.1. As a workaround, check CSV content before importing it.

Affected (CNA)

Vendor / product	Versions
Combodo / iTop	affected < 3.1.3; affected >= 3.2.0, < 3.2.1

CWE

CWE-79

References

https://github.com/Combodo/iTop/security/advisories/GHSA-6p48-74j9-977j

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.