What’s Vulnerable › Vulnerabilities

CVE-2021-32664: Reflected XSS in Combodo/iTop

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-10-19 · updated 2026-06-17
• Weakness: CWE-79

Description

Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5.

Affected products

• Combodo iTop: before 2.6.5; from 2.7.0 before 2.7.5 — fixed in 2.6.5, 2.7.5

How to fix

Upgrade to a fixed version: Combodo iTop 2.6.5, 2.7.5. Check the vendor advisory for mitigations.

References

• https://github.com/Combodo/iTop/commit/4f5c987d8b1bd12814dc606ea69b6cfb88490704
• https://github.com/Combodo/iTop/commit/84741c19f0af6fa8e7082a8807eb089182e7b88a
• https://github.com/Combodo/iTop/commit/86f649affc12b5078efc86d9439d67d98f4cb2f6
• https://github.com/Combodo/iTop/security/advisories/GHSA-j758-ggwg-9mpj
• https://github.com/Combodo/iTop/commit/4f5c987d8b1bd12814dc606ea69b6cfb88490704
• https://github.com/Combodo/iTop/commit/84741c19f0af6fa8e7082a8807eb089182e7b88a
• https://github.com/Combodo/iTop/commit/86f649affc12b5078efc86d9439d67d98f4cb2f6
• https://github.com/Combodo/iTop/security/advisories/GHSA-j758-ggwg-9mpj

Get alerted when CVE-2021-32664 or the next vulnerability affects your stack