CVE-2021-32664 : Combodo iTop is an open source web based IT Service Management tool. In affected

Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5.

Published 2021-10-19 18:15:08

Updated 2021-10-22 20:45:48

Source GitHub, Inc.

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2021-32664

Combodo » Itop »
Versions before (<) 2.6.5
cpe:2.3:a:combodo:itop:*:*:*:*:-:*:*:*
Matching versions
Combodo » Itop »
Versions from including (>=) 2.7.0 and before (<) 2.7.5
cpe:2.3:a:combodo:itop:*:*:*:*:-:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-32664

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 39 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-32664

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.5	LOW	AV:N/AC:M/Au:S/C:N/I:P/A:N	6.8	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
4.8	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	1.7	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None
8.1	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N	1.7	5.8	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: Required Scope: Changed Confidentiality: High Integrity: High Availability: None

CWE ids for CVE-2021-32664

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: security-advisories@github.com (Primary)

References for CVE-2021-32664

https://github.com/Combodo/iTop/security/advisories/GHSA-j758-ggwg-9mpj

Reflected XSS with Administrator credentials · Advisory · Combodo/iTop · GitHub
Third Party Advisory
https://github.com/Combodo/iTop/commit/4f5c987d8b1bd12814dc606ea69b6cfb88490704

N°4002 - code hardening · Combodo/iTop@4f5c987 · GitHub
Patch;Third Party Advisory
https://github.com/Combodo/iTop/commit/86f649affc12b5078efc86d9439d67d98f4cb2f6

N°4002 - code hardening · Combodo/iTop@86f649a · GitHub
Patch;Third Party Advisory
https://github.com/Combodo/iTop/commit/84741c19f0af6fa8e7082a8807eb089182e7b88a

N°4002 - code hardening (merge from support/2.6) · Combodo/iTop@84741c1 · GitHub
Patch;Third Party Advisory

Jump to

Vulnerability Details : CVE-2021-32664

Products affected by CVE-2021-32664

Exploit prediction scoring system (EPSS) score for CVE-2021-32664

CVSS scores for CVE-2021-32664

CWE ids for CVE-2021-32664

References for CVE-2021-32664