CVE-2023-44396

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-44396
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-44396.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-44396
Aliases
  • GHSA-gqqj-jgh6-3x35
Published
2024-04-15T17:13:45.144Z
Modified
2026-07-15T01:48:58.624484434Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N CVSS Calculator
Summary
iTop vulnerable to XSS in dashlet modifications ajax endpoints
Details

iTop is an IT service management platform. Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/44xxx/CVE-2023-44396.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79",
        "CWE-80"
    ]
}
References

Affected packages

Git / github.com/combodo/itop

Affected ranges

Type
GIT
Repo
https://github.com/combodo/itop
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
94f9b16c03c4f9a232f677212aecde616b09b95e
Introduced
682c821d0ef14224b2182ea5840ae1739600bc22
Fixed
b8892e965161992618dbfdbe6aa89eda79d6c92d
Introduced
9b409b117f4b5308678d6ab4f3e3ea6dc1fd58cd
Fixed
be699b4358b253d34835f763316877a66e1ba072
Fixed
9df92665e08c4bf5d4d8a5a9fe21fd3fb26fb273
Fixed
c72cb7e70ebf469ce0ec01f5f9b524e39afe6c7f
Database specific 
{
    "cpe": "cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.7.1"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.4"
        },
        {
            "introduced": "3.1.0"
        },
        {
            "fixed": "3.1.1"
        }
    ]
}

Affected versions

1.*
1.0.8
2.*
2.6.1
2.6.2
2.6.3
2.7.0-alpha1
2.7.0-beta
2.7.0-beta2
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
3.*
3.0.0
3.0.1
3.0.1-designer-feature-lot1
3.0.1-designer-feature-lot2
3.0.2-rc1
3.0.3
3.0.3-designer-php8.0-compatibility
3.1.0-alpha1
3.1.0-designer-2
ITSM_Designer_3.*
ITSM_Designer_3.1-compatibility
Other
N1963
N2011
N2016
N941
N941-2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-44396.json"