PT-2025-46199 · Comodo · Itop

Published 2025-11-10 · Updated 2025-11-21 · CVE-2025-64167

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 2.7.13 Combodo iTop versions prior to 3.2.2

Description Combodo iTop, a web-based IT service management tool, is susceptible to a cross-site scripting (XSS) attack that can result in JavaScript (JS) execution. The issue occurs when editing the URL parameter. Versions 2.7.13 and 3.2.2 utilize export-v2.php instead of the deprecated export.php. The vulnerable parameter is URL.

Recommendations Update to Combodo iTop version 2.7.13 or later. Update to Combodo iTop version 3.2.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-64167

GHSA-PR7W-2CR9-5H38

Affected Products

Itop

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64167.json · Exploit
• https://github.com/Combodo/iTop/security/advisories/GHSA-pr7w-2cr9-5h38 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64167 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64167 · Vendor Advisory
• https://t.me/cveNotify/143562 · Telegram Post
• https://twitter.com/CVEnew/status/1987996709893427458 · Twitter Post