CVE-2023-34443: Cross-site Scripting vulnerability in the run_query.php page in Combodo iTop

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-05 · updated 2026-06-17
Weakness: CWE-79

Description

Combodo iTop is a simple, web based IT Service Management tool. When displaying page Run queries Cross-site Scripting (XSS) are possible for scripts outside of script tags. This has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

Combodo iTop: before 2.7.9; from 3.0.0 before 3.0.4 — fixed in 2.7.9, 3.0.4

How to fix

Upgrade to a fixed version: Combodo iTop 2.7.9, 3.0.4. Check the vendor advisory for mitigations.

References

https://github.com/Combodo/iTop/security/advisories/GHSA-9mx6-pwpp-j3xx
https://huntr.dev/bounties/c230d55d-1f0e-40c3-8c7e-20587d3e54da/?token=4d1195d5a50a9f0f7ae9fc24a2b0a3bd907427edaf7ee6ac1f8f31c11d8b7a5d2c204957125e63fd7cf3a87df6d5d12a35f9c7107ba5f33b5f668fa199a36932448b9bf186daa62cb32b5635770730eb68eeeba079b8864ab00358fd0dc65fa406d986525814a14951db2025e117f0098a1f270f5a5b2c935a65b00b5106e5511b61d501c4357654cb8ea76b

Get alerted when CVE-2023-34443 or the next vulnerability affects your stack