CVE Vulnerability

CVE-2021-41161

Combodo iTop is a web based IT Service Management tool. In versions prior to 3.0.0-beta6 the export CSV page don't properly escape the user supplied parameters, allowing for javascript injection into rendered csv files. Users are advised to upgrade. There are no known workarounds for this issue.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

6.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/Combodo/iTop/security/advisories/GHSA-788f-g6g9-f8fc Third Party Advisory
https://github.com/Combodo/iTop/commit/c8f3d23d30c018bc44189b38fa34a5fffb4edb22 Patch Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:combodo:itop:3.0.0:beta:*:*:*:*:*:*
cpe:2.3:a:combodo:itop:3.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:combodo:itop:3.0.0:beta3:*:*:*:*:*:*
cpe:2.3:a:combodo:itop:3.0.0:beta4:*:*:*:*:*:*
cpe:2.3:a:combodo:itop:3.0.0:beta5:*:*:*:*:*:*
cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*
Information

Published : 2022-04-21 05:15

Updated : 2022-05-04 07:10

NVD link : CVE-2021-41161

Mitre link : CVE-2021-41161

Products Affected
No products.
CWE
CWE-79