What’s Vulnerable › Vulnerabilities

CVE-2021-41162: Cross-site Scripting in Combodo iTop

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-04-21 · updated 2026-06-17
• Weakness: CWE-79

Description

Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to beta6 the `ajax.render.php?operation=wizard_helper` page did not properly escape the user supplied parameters, allowing for a cross site scripting attack vector. Users are advised to upgrade. There are no known workarounds for this issue.

Affected products

• Combodo iTop: through 2.7.6; 3.0.0-beta, 3.0.0-beta1, 3.0.0-beta2, 3.0.0-beta3, 3.0.0-beta4, 3.0.0-beta5

References

• https://github.com/Combodo/iTop/commit/83125d9ae16cfb2527b9d0ab0805a68b863244a0
• https://github.com/Combodo/iTop/security/advisories/GHSA-w5jw-hfvp-gx95
• https://github.com/Combodo/iTop/commit/83125d9ae16cfb2527b9d0ab0805a68b863244a0
• https://github.com/Combodo/iTop/security/advisories/GHSA-w5jw-hfvp-gx95

Get alerted when CVE-2021-41162 or the next vulnerability affects your stack