What’s Vulnerable › Vulnerabilities

CVE-2020-15221: XSS in the breadcrumbs

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-01-13 · updated 2026-06-17
• Weakness: CWE-79

Description

Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, by modifying target browser local storage, an XSS can be generated in the iTop console breadcrumb. This is fixed in versions 2.7.2 and 3.0.0.

Affected products

• Combodo iTop: before 2.7.2; 3.0.0-alpha — fixed in 2.7.2

How to fix

Upgrade to a fixed version: Combodo iTop 2.7.2. Check the vendor advisory for mitigations.

References

• https://github.com/Combodo/iTop/security/advisories/GHSA-w6g2-p7pf-7hvw
• https://github.com/Combodo/iTop/security/advisories/GHSA-w6g2-p7pf-7hvw

Get alerted when CVE-2020-15221 or the next vulnerability affects your stack