CVE-2023-47488: Combodo iTop v · Cross-site Scripting
Source CVE Database V5
Not known to be exploited · CVSS 6.1 Medium.
Data as of 26 Oct 2026, 10:12 UTC
- EPSS
- 1.2% chance of exploitation in 30 days – higher than 69% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 9 Nov 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
- Immediate mitigation should include restricting access to the affected iTop instance to trusted users only, minimizing exposure to potential attackers.
- Implement strict input validation and output encoding on the attrib_manager_id and id parameters to neutralize malicious scripts, ideally by applying Content Security Policy (CSP) headers to limit script execution sources.
- Educate users about the risks of clicking on untrusted links or interacting with suspicious content within the iTop environment to reduce the risk of user interaction exploitation.
- Monitor web application logs for unusual parameter values or repeated attempts to inject scripts, enabling early detection of exploitation attempts.
- If possible, deploy web application firewalls (WAF) with rules designed to detect and block XSS payloads targeting these parameters.
- Engage with Combodo or the iTop community to obtain or develop patches that properly sanitize inputs and address the vulnerability.
- Consider isolating the iTop application within a segmented network zone to limit the impact of any successful exploitation.
- Regularly review and update user privileges to ensure least privilege principles are enforced, reducing the potential damage from compromised accounts.
Description
Cross Site Scripting vulnerability in Combodo iTop v.3.1.0-2-11973 allows a local attacker to obtain sensitive information via a crafted script to the attrib_manager_id parameter in the General Information page and the id parameter in the contact page.