A reflected Cross‑Site Scripting (XSS) flaw exists in the foreign key search criteria API of Combodo iTop. The vulnerability can cause malicious scripts to run in a victim’s browser when the API is invoked with crafted input. Successful exploitation can enable an attacker to steal session cookies, hijack user accounts, or modify page content, representing a client‑side code execution risk defined by CWE‑79.

Combodo’s iTop service‑management platform versions prior to 3.2.3 are vulnerable. The issue originates in the web‑based search functionality exposed by these releases.

The CVSS score of 8.8 classifies the flaw as High severity. While the EPSS score is not available, the absence of a KEV listing suggests no known active exploitation, though the lack of data does not eliminate risk. The attack vector is likely remote, soliciting a crafted request to the foreign key search endpoint, and requires user interaction with the resulting page. Even if authentication is needed, the vulnerability remains dangerous because it can be used to compromise any user who views the reflected payload.