Combodo iTop, a web‑based IT service management tool, had a reflected Cross‑Site Scripting flaw in the dashboard save function prior to version 3.2.3. The vulnerability allows an attacker to inject arbitrary JavaScript into the page that is presented to a user when a dashboard is saved or viewed. If an attacker can supply a crafted dashboard title or other field that is reflected back in the response, the malicious script could steal session cookies, deface the interface, or perform other client‑side attacks, compromising confidentiality and integrity for the victim’s session.

All installations of Combodo iTop older than version 3.2.3 are affected, regardless of service attachment. The flaw was fixed in the 3.2.3 release, so anyone running iTop prior to that should consider upgrading.

The vulnerability carries a CVSS score of 7.1. An exploit does not require any special privileges beyond the ability to access the dashboard save endpoint, which may require an authenticated session. As a reflected XSS, the attack would affect only the victim’s browser, but its impact can lead to credential theft or defacement. EPSS data is not available and the issue is not listed in the CISA KEV catalog, suggesting that no large‑scale automated exploitation has been reported yet. Nevertheless, the relatively high CVSS and the ease of exploitation warrant timely remediation.