CVE-2019-13965 Cross-site scripting in n/a

Medium 6.1 Published 14 Feb 2020 Updated 5 Aug 2024

Attackers can execute arbitrary scripts via unsanitized error messages, potentially leading to remote code execution and account takeover in iTop.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2019-13965?

CVE-2019-13965 is a medium-severity cross-site scripting vulnerability in Combodo Itop, published on 14 Feb 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Because of a lack of sanitization around error messages, multiple Reflective XSS issues exist in iTop through 2.6.0 via the param_file parameter to webservices/export.php, webservices/cron.php, or env-production/itop-backup/backup.php. By default, any XSS sent to the administrator can be transformed to remote command execution because of CVE-2018-10642 (still working through 2.6.0) The Reflective XSS can also become a stored XSS within the same account because of another vulnerability.

Weakness: CWE-79

Which versions are affected by CVE-2019-13965?

It affects 1 product.

Products include Combodo Itop.

How do I fix CVE-2019-13965?

No fix has been published for CVE-2019-13965 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2019-13965 being exploited?

There is no known exploitation of CVE-2019-13965 in the wild and no public exploit code.

All Combodo Itop vulnerabilities

Sources

Also known as GHSA-4969-q73g-ghxm.