iTop Cross Site Scripting and HTML Injection Vulnerabilities

Bugtraq ID:	50782
Class:	Input Validation Error
CVE:	CVE-2011-4275
Remote:	Yes
Local:	No
Published:	Nov 23 2011 12:00AM
Updated:	Nov 23 2011 12:00AM
Credit:	Tobias Glemser
Vulnerable:	iTop iTop 1.1.181
Not Vulnerable:	iTop iTop 1.2

iTop Cross Site Scripting and HTML Injection Vulnerabilities

iTop is prone to a cross-site scripting vulnerability and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

iTop 1.1.181 is vulnerable; other versions may also be affected.

iTop Cross Site Scripting and HTML Injection Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting user to follow a malicious URI. The attacker can exploit the HTML-injection issues with a browser.

iTop Cross Site Scripting and HTML Injection Vulnerabilities

Solution:
Updates are available. Please see the reference for more details.

iTop Cross Site Scripting and HTML Injection Vulnerabilities

References:

• iTop Sourceforge Page (iTop)
  
• TC-SA-2011-02: Multiple web-vulnerabilities in iTop version 1.1.181 (Tobias Glemser" )