CVE-2020-11697 - In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload

Back Back to CVE browser

MEDIUM

In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload

Published Jun 5, 2020

6.1

MEDIUM

CVSS 3.1

EPSS 0.69%

Description

In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://github.com/Combodo/iTop/security/advisories/GHSA-xfh9-5632-hxmv
x_refsource_CONFIRMThird Party Advisory
https://www.itophub.io/wiki/page?id=2_7_0%3Arelease%3A2_7_whats_new
x_refsource_CONFIRMRelease NotesVendor Advisory

Link	Providers	Tags
https://github.com/Combodo/iTop/security/advisories/GHSA-xfh9-5632-hxmv		x_refsource_CONFIRMThird Party Advisory
https://www.itophub.io/wiki/page?id=2_7_0%3Arelease%3A2_7_whats_new		x_refsource_CONFIRMRelease NotesVendor Advisory