The CVSS 8 for this reflected XSS in iTop's tagadmin.php makes sense only if you're accounting for what an admin session actually provides: direct access to the CMDB, which is a comprehensive map of infrastructure topology, service dependencies, and often integration credentials for connected systems. That's the real blast radius the score doesn't capture — an attacker compromising an admin account via a phishing link doesn't need to escalate further within iTop; they've already won the reconnaissance phase for the entire connected environment.
The patch in 3.2.3 was almost certainly a localized htmlspecialchars() call on a single parameter. That pattern is the tell. Combodo found the symptom, patched it, and moved on — there's no evidence of systemic output encoding hardening or Content Security Policy deployment. This matters because ITSM frameworks built on PHP have a documented history of exactly this localized fix pattern, and the evidence suggests it produces false closure: organizations patch tagadmin.php and stop auditing, while tag-adjacent endpoints (tag-based search, tag categorization, tag inheritance) go unexamined.
The privilege question matters operationally. If tagadmin.php is behind a VPN or IP restriction, the phishing bar is higher. But iTop increasingly deploys with SAML or OIDC federation, which means the admin interface may be accessible from anywhere — a reflected XSS in an admin page becomes a credential theft vector that bypasses perimeter assumptions.
The timeline is worth flagging for defenders: if 3.2.3 bundled this fix with non-security changes, organizations with rigorous change management may have deferred the update. The effective exposure window is likely longer than the patch date suggests.