High severity8.7NVD Advisory· Published Apr 21, 2022· Updated Jun 17, 2026

CVE-2022-24870

Description

Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to 3.0.0 beta3 a malicious script can be injected in tooltips using iTop customization mechanism. This provides a stored cross site scripting attack vector to authorized users of the system. Users are advised to upgrade. There are no known workarounds for this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Combodo/Itop4 versions
cpe:2.3:a:combodo:itop:3.0.0:beta2:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:combodo:itop:3.0.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:combodo:itop:3.0.0:beta:*:*:*:*:*:*
- (no CPE)range: <3.0.0 beta3
- (no CPE)range: >= 3.0.0-beta, < 3.0.0-beta3

Patches

Vulnerability mechanics

References

www.github.com/combodo/itop/commit/ebbf6e56befda2070b00d68c7c3e531a6ce6b59envdPatchThird Party Advisory
huntr.dev/bounties/1625056040123-Combodo/iTop/nvdExploitPatchThird Party Advisory
github.com/Combodo/iTop/security/advisories/GHSA-29h7-jw2p-pcw3nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.565
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000