Prior to version 3.2.3 of the Combodo iTop web‑based IT service management tool, the synchronization import script at synchro/synchro_import.php contains a reflected cross‑site scripting vulnerability. Attackers can inject malicious JavaScript into a URL that the script processes and subsequently returns unescaped in the page. This flaw allows them to execute arbitrary client‑side code in victims’ browsers when they view the affected page, potentially enabling session hijacking, credential theft, or defacement. The issue is a classic input validation weakness identified as CWE‑79.

The flaw applies to any installation of Combodo iTop older than version 3.2.3. The vulnerable path is exposed through the synchro/synchro_import.php endpoint, which can be accessed by authenticated users or possibly unauthenticated attackers depending on deployment. Therefore, all systems running the affected iTop releases require immediate attention.

The CVSS score of 8.0 classifies this as a high‑risk vulnerability. EPSS is not available, so the system cannot gauge current exploitation probability. The vulnerability is not listed in CISA's KEV catalog, indicating that no confirmed exploits are publicly known. Nonetheless, reflected XSS flaws are widely used by attackers to compromise web applications, so the risk remains significant. Exploitation requires only crafting a malicious link that targets the synchro_import.php endpoint; the attacker needs no prior authentication if the script is publicly reachable, otherwise the attacker can target authenticated users.