CVE-2025-48055: Combodo iTop XSS Vulnerability

CVE-2025-48055 Overview

Combodo iTop is a web-based IT service management (ITSM) tool used by enterprises to manage configuration items, incidents, and change requests. CVE-2025-48055 is a cross-site scripting (XSS) vulnerability [CWE-79] affecting iTop versions prior to 3.2.2. The flaw occurs when content is displayed within a browse brick in the user portal, allowing an authenticated attacker to inject script content that executes in another user's browser session.

Combodo released fixes in iTop versions 3.2.2 and 3.3.0.

Critical Impact

Authenticated attackers can inject scripts into browse brick content rendered in the user portal, enabling session hijacking, credential theft, or targeted actions against portal users.

Affected Products

• Combodo iTop versions prior to 3.2.2
• Combodo iTop 3.x branch (fixed in 3.2.2)
• Combodo iTop 3.3.x branch (fixed in 3.3.0)

Discovery Timeline

• 2025-11-10 - CVE-2025-48055 published to the National Vulnerability Database
• 2026-10-07 - Last updated in NVD database

Technical Details for CVE-2025-48055

Vulnerability Analysis

The vulnerability resides in the browse brick component of the iTop user portal. Browse bricks render object attributes and related data to end users as part of the self-service portal experience. When iTop displays certain field content in the browse brick, the application fails to properly sanitize or encode user-controlled values before including them in the generated HTML response.

An authenticated user with privileges to populate affected object fields can insert HTML or JavaScript payloads. When another portal user navigates to the browse brick that renders the tainted object, the injected script executes in the victim's browser under the iTop origin. Because the attack requires user interaction and runs in a victim session, the resulting scope change affects confidentiality and integrity of that session.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The browse brick rendering path does not consistently HTML-encode object attribute values that originate from attacker-controllable fields. This allows markup supplied through legitimate iTop data entry workflows to survive into the DOM of the user portal.

Attack Vector

Exploitation requires an attacker with authenticated access and the ability to write to an object attribute that will be surfaced by a browse brick. The attacker stores a script payload in that attribute. When a portal user views the browse brick containing the object, the payload executes. The attack is network-reachable and requires user interaction from the victim.

See the Combodo iTop GitHub Security Advisory GHSA-684h-f39j-5gq8 for vendor technical details.

Detection Methods for CVE-2025-48055

Indicators of Compromise

• Object attribute values in the iTop database containing HTML tags such as <script>, <img onerror=, <svg onload=, or javascript: URIs where plaintext is expected.
• Browser console errors or Content Security Policy violation reports originating from portal pages that render browse bricks.
• Unexpected outbound HTTP requests from portal user browsers to attacker-controlled domains following browse brick views.

Detection Strategies

• Query the iTop database for object attributes containing angle brackets, on* event handler strings, or encoded script markers across tables exposed through browse bricks.
• Review web server access logs for portal requests containing reflected or stored XSS payload patterns targeting portal endpoints.
• Enable and monitor Content Security Policy reporting on the iTop portal to surface inline script execution attempts.

Monitoring Recommendations

• Audit iTop user activity logs for data modifications performed by low-privilege accounts on fields rendered in portal browse bricks.
• Alert on anomalous session activity, such as account changes or ticket actions originating immediately after a portal browse brick view.
• Track iTop version information across hosted instances to confirm patched builds are deployed.

How to Mitigate CVE-2025-48055

Immediate Actions Required

• Upgrade Combodo iTop to version 3.2.2 or 3.3.0, whichever matches your current maintenance branch.
• Review audit logs for recent modifications to object attributes that appear in portal browse bricks.
• Rotate active portal session cookies and credentials if evidence of exploitation is found.

Patch Information

Combodo fixed CVE-2025-48055 in iTop 3.2.2 and 3.3.0. Administrators should apply the appropriate upgrade following the vendor upgrade procedure. Refer to the Combodo iTop GitHub Security Advisory GHSA-684h-f39j-5gq8 for release details and fix commits.

Workarounds

• Restrict portal write access so only trusted roles can modify object attributes rendered by browse bricks.
• Deploy a strict Content Security Policy on the iTop portal that disallows inline scripts and limits script sources.
• Place a web application firewall in front of the portal with rules that block common XSS payload patterns in POST bodies and query parameters.

# Example CSP header for the iTop portal (adjust sources to your environment)
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"