First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2023-44396

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

iTop is an IT service management platform. Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Combodo	iTop	< 2.7.1; >= 3.0.0, < 3.0.4; >= 3.1.0, < 3.1.1

References

Timeline

Published: Apr 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-443979.8CloudExplorer Lite is an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter of CloudExplorer Lit CVE-2023-443988.8Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds CVE-2023-443995.3ZITADEL provides identity infrastructure. In versions 2.37.2 and prior, ZITADEL administrators can enable a setting called "Ignoring unknown CVE-2023-44409.8A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0. It has been classified as critical. Thi CVE-2023-444007.8Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account CVE-2023-444015.3The Silverstripe CMS GraphQL Server serves Silverstripe data as GraphQL representations. In versions 4.0.0 prior to 4.3.7 and 5.0.0 prior to CVE-2023-444027.0Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. This only impacts apps CVE-2023-444038.8D-Link DAP-1325 HNAP SetWLanRadioSettings Channel Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-a CVE-2023-444048.8D-Link DAP-1325 get_value_from_app Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjace CVE-2023-444058.8D-Link DAP-1325 get_value_of_key Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent CVE-2023-444068.8D-Link DAP-1325 SetAPLanSettings DeviceName Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows netwo CVE-2023-444078.8D-Link DAP-1325 SetAPLanSettings Gateway Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-

CVE-2023-44396: Medium severity, CVSS 5.4 | Vulnix