CVE-2022-24811

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Combodi iTop is a web based IT Service Management tool. Prior to versions 2.7.6 and 3.0.0, cross-site scripting is possible for scripts outside of script tags when displaying HTML attachments. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Combodo	iTop	< 2.7.6

References

https://github.com/Combodo/iTop/commit/92a9a8c65f3cbb2cd4414ca3a3b45a5754ba57b4Patch, Third Party Advisory
https://github.com/Combodo/iTop/security/advisories/GHSA-67x5-mqg4-rvgcThird Party Advisory
https://huntr.dev/bounties/1625056478879-Combodo/iTop/Exploit, Third Party Advisory
https://github.com/Combodo/iTop/commit/92a9a8c65f3cbb2cd4414ca3a3b45a5754ba57b4Patch, Third Party Advisory
https://github.com/Combodo/iTop/security/advisories/GHSA-67x5-mqg4-rvgcThird Party Advisory
https://huntr.dev/bounties/1625056478879-Combodo/iTop/Exploit, Third Party Advisory

Timeline

Published: Apr 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-248128.8Grafana is an open-source platform for monitoring and observability. When fine-grained access control is enabled and a client uses Grafana A CVE-2022-248135.3CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be ma CVE-2022-248146.1Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript (JS) can be CVE-2022-248158.1JHipster is a development platform to quickly generate, develop, & deploy modern web applications & microservice architectures. SQL Injectio CVE-2022-2481610.0JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided v CVE-2022-248179.9Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 CVE-2022-248187.2GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can CVE-2022-248195.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to v CVE-2022-24828.8A vulnerability exists in Nokia’s ASIK AirScale system module (versions 474021A.101 and 474021A.102) that could allow an attacker to place a CVE-2022-248205.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to v CVE-2022-248218.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/CVE-2022-248227.5Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a mod