CVE-2023-44396 (PHP, published 2024-04-15T18:15Z)
Description: value: iTop is an IT service management platform.  Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Combodo/iTop
Files changed:
application/utils.inc.php
Commit message: N°6606 Backport of utils::ENUM_SANITIZATION_FILTER_* constants
Were introduced in 3.0.0, but not added to the support/2.7 branch


Vulnerable code:
	 * @param string $sSanitizationFilter one of : integer, class, string, context_param, parameter, field_name,
	 *               element_identifier, transaction_id, parameter, raw_data
			case 'integer':
			case 'class':
			case 'string':
			case 'context_param':
			case 'parameter':
			case 'field_name':
			case 'transaction_id':
						case 'transaction_id':
						case 'parameter':
						case 'field_name':
						case 'context_param':
			case 'element_identifier':
			case 'url':
			case 'raw_data':

Fixed code:
	/**
	 * @var string
	 * @since 2.7.10 3.0.0
	 */
	public const ENUM_SANITIZATION_FILTER_INTEGER = 'integer';
	/**
	 * @var string
	 * @since 2.7.10 3.0.0
	 */
	public const ENUM_SANITIZATION_FILTER_CLASS = 'class';
	/**
	 * @var string
	 * @since 2.7.10 3.0.0
	 */
	public const ENUM_SANITIZATION_FILTER_STRING = 'string';
	/**
	 * @var string
	 * @since 2.7.10 3.0.0
	 */
	public const ENUM_SANITIZATION_FILTER_CONTEXT_PARAM = 'context_param';
	/**
	 * @var string
	 * @since 2.7.10 3.0.0
	 */
	public const ENUM_SANITIZATION_FILTER_PARAMETER = 'parameter';
	/**
	 * @var string
	 * @since 2.7.10 3.0.0
	 */
	public const ENUM_SANITIZATION_FILTER_FIELD_NAME = 'field_name';
	/**
	 * @var string
	 * @since 2.7.10 3.0.0
	 */
	public const ENUM_SANITIZATION_FILTER_TRANSACTION_ID = 'transaction_id';
	/**
	 * @var string For XML / HTML node identifiers
	 * @since 2.7.10 3.0.0
	 */
	public const ENUM_SANITIZATION_FILTER_ELEMENT_IDENTIFIER = 'element_identifier';
	/**
	 * @var string
	 * @since 2.7.10 3.0.0
	 */
	public const ENUM_SANITIZATION_FILTER_RAW_DATA = 'raw_data';
	/**
	 * @var string
	 * @since 3.0.2 3.1.0 N°4899
	 * @since 2.7.10 N°6606
	 */
	public const ENUM_SANITIZATION_FILTER_URL = 'url';

	/**
	 * @var string
	 * @since 3.0.0
	 * @since 2.7.10 N°6606
	 */
	public const DEFAULT_SANITIZATION_FILTER = self::ENUM_SANITIZATION_FILTER_RAW_DATA;

	 * @param string $sSanitizationFilter one of utils::ENUM_SANITIZATION_* const
	 * @since 2.7.10 N°6606 use the utils::ENUM_SANITIZATION_* const
	 *
	 * @link https://www.php.net/manual/en/filter.filters.sanitize.php PHP sanitization filters
			case static::ENUM_SANITIZATION_FILTER_INTEGER:
			case static::ENUM_SANITIZATION_FILTER_CLASS:
			case static::ENUM_SANITIZATION_FILTER_STRING:
			case static::ENUM_SANITIZATION_FILTER_CONTEXT_PARAM:
			case static::ENUM_SANITIZATION_FILTER_PARAMETER:
			case static::ENUM_SANITIZATION_FILTER_FIELD_NAME:
			case static::ENUM_SANITIZATION_FILTER_TRANSACTION_ID:
						case static::ENUM_SANITIZATION_FILTER_TRANSACTION_ID:
						case static::ENUM_SANITIZATION_FILTER_PARAMETER:
						case static::ENUM_SANITIZATION_FILTER_FIELD_NAME:
						case static::ENUM_SANITIZATION_FILTER_CONTEXT_PARAM:
			case static::ENUM_SANITIZATION_FILTER_ELEMENT_IDENTIFIER:
			case static::ENUM_SANITIZATION_FILTER_URL:
			case static::ENUM_SANITIZATION_FILTER_RAW_DATA: