PT-2022-16891 · Combodi+1 · Combodo Itop+1

Ranjit-Git · Published 2022-04-05 · Updated 2024-04-04 · CVE-2022-24811

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Combodi iTop versions prior to 2.7.6 and 3.0.0

Description Combodi iTop is a web-based IT Service Management tool. The issue allows for cross-site scripting for scripts outside of script tags when displaying HTML attachments. There are currently no known workarounds for this issue.

Recommendations For versions prior to 2.7.6, update to version 2.7.6 or later. For versions prior to 3.0.0, update to version 3.0.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2023-1879

ALT-PU-2024-4537

ALT-PU-2024-4547

ALT-PU-2024-4961

CVE-2022-24811

GHSA-67X5-MQG4-RVGC

Affected Products

Alt Linux

Combodo Itop

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24811.json · Exploit
• 🔥 https://huntr.dev/bounties/1625056478879-Combodo/iTop · Exploit
• https://github.com/Combodo/iTop/commit/92a9a8c65f3cbb2cd4414ca3a3b45a5754ba57b4 · Patch
• https://osv.dev/vulnerability/CVE-2022-24811 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24811 · Security Note
• https://github.com/Combodo/iTop/security/advisories/GHSA-67x5-mqg4-rvgc · Note
• https://t.me/cibsecurity/40193 · Telegram Post
• https://t.me/cvenotify/28478 · Telegram Post