CVE-2025-47932: Combodo iTop XSS Vulnerability

CVE-2025-47932 Overview

Combodo iTop is a web-based IT service management (ITSM) tool used by organizations to track configuration items, incidents, and change requests. CVE-2025-47932 is a cross-site scripting (XSS) vulnerability that affects iTop versions prior to 2.7.13 and 3.2.2. The flaw is triggered when a dashboard is rendered through an AJAX call, allowing an attacker to inject script content that executes in a victim's browser session. Combodo addressed the issue by sanitizing the vulnerable variable in versions 2.7.13 and 3.2.2. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation lets an attacker execute arbitrary JavaScript in the browser of an authenticated iTop user, enabling session theft, UI defacement, or actions performed on behalf of the victim.

Affected Products

Combodo iTop versions prior to 2.7.13
Combodo iTop 3.x versions prior to 3.2.2
Dashboard rendering component invoked via AJAX

Discovery Timeline

2025-11-10 - CVE-2025-47932 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47932

Vulnerability Analysis

The vulnerability resides in the dashboard rendering path that is triggered by an AJAX request. When the server returns dashboard content, one of the variables that participates in the response is included in the generated HTML without proper output encoding. An attacker who can influence that variable, for example through a crafted URL or dashboard parameter delivered to a target user, can cause arbitrary JavaScript to run in the victim's browser under the iTop origin.

Because iTop is used by IT operations teams, an attacker who lands script execution in an administrator session can read or modify configuration management database (CMDB) content, tickets, and workflows through the victim's authenticated context. The user interaction requirement means the attack typically depends on delivering a crafted link to an authenticated iTop user.

Root Cause

The root cause is missing output sanitization on a variable used during AJAX-based dashboard rendering. The affected code path emitted attacker-controllable data into the HTML response without applying HTML entity encoding or a comparable escaping routine. Combodo's fix in 2.7.13 and 3.2.2 sanitizes the responsible variable before it is written to the response.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL or request that causes the AJAX dashboard endpoint to reflect malicious script content, then convinces an authenticated iTop user to load it. The scope is changed because script executed in the iTop origin can affect resources beyond the vulnerable component. See the Combodo GitHub Security Advisory GHSA-rmxq-fx69-7wg5 for vendor details.

No public proof-of-concept is listed for this CVE, and it is not present in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-47932

Indicators of Compromise

HTTP requests to iTop dashboard AJAX endpoints containing HTML tags, <script>, onerror=, onload=, or URL-encoded equivalents in query parameters.
Server-side iTop logs showing dashboard render calls with unusually long or encoded parameter values originating from external referrers.
Browser console errors or unexpected outbound requests from iTop pages to attacker-controlled domains.

Detection Strategies

Inspect web server and reverse proxy access logs for AJAX dashboard requests containing script payload signatures and correlate with authenticated user sessions.
Deploy web application firewall (WAF) rules that flag reflected XSS patterns targeting iTop dashboard parameters.
Review iTop audit logs for privileged actions taken shortly after a user loaded a dashboard from an external link.

Monitoring Recommendations

Alert on outbound HTTP requests from browsers immediately following interaction with iTop URLs that carry encoded HTML in parameters.
Monitor for new or unexpected iTop administrator activity following delivery of external links to operations staff.
Track iTop version strings in asset inventories to confirm all instances are running 2.7.13, 3.2.2, or later.

How to Mitigate CVE-2025-47932

Immediate Actions Required

Upgrade iTop to version 2.7.13 for the 2.7 branch or 3.2.2 for the 3.x branch as documented in the vendor advisory.
Restrict access to the iTop web interface to trusted networks or a VPN while patching is scheduled.
Instruct iTop users, especially administrators, to avoid loading iTop dashboard links received from untrusted sources.

Patch Information

Combodo released fixed builds 2.7.13 and 3.2.2 that sanitize the variable responsible for the XSS in the AJAX dashboard rendering path. Details and download references are available in the GitHub Security Advisory GHSA-rmxq-fx69-7wg5.

Workarounds

Place iTop behind a WAF with rules that block reflected XSS payloads in query and POST parameters targeting dashboard endpoints.
Enforce a strict Content Security Policy (CSP) on the iTop application to limit inline script execution and restrict script sources.
Set the HttpOnly and Secure flags on iTop session cookies to reduce the impact of session token theft through script execution.

bash

# Example nginx snippet to enforce a restrictive CSP and secure cookies
# in front of an iTop instance until patching is complete
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
proxy_cookie_path / "/; HttpOnly; Secure; SameSite=Lax";