Описание
Combodo iTop is a web based IT Service Management tool. In versions prior to 3.0.0-beta6 the export CSV page don't properly escape the user supplied parameters, allowing for javascript injection into rendered csv files. Users are advised to upgrade. There are no known workarounds for this issue.
Ссылки
- PatchThird Party Advisory
- Third Party Advisory
- PatchThird Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 3.0.0 (исключая)
Одно из
cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*
cpe:2.3:a:combodo:itop:3.0.0:beta:*:*:*:*:*:*
cpe:2.3:a:combodo:itop:3.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:combodo:itop:3.0.0:beta3:*:*:*:*:*:*
cpe:2.3:a:combodo:itop:3.0.0:beta4:*:*:*:*:*:*
cpe:2.3:a:combodo:itop:3.0.0:beta5:*:*:*:*:*:*
EPSS
Процентиль: 54%
0.00311
Низкий
9.3 Critical
CVSS3
6.1 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-79
CWE-79
EPSS
Процентиль: 54%
0.00311
Низкий
9.3 Critical
CVSS3
6.1 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-79
CWE-79