CVE-2025-24026

MEDIUM

iTop < 3.2.1 - Denial of Service via Regular Expression Complexity

Title source: llm
STIX 2.1

Description

iTop is an web based IT Service Management tool. Versions prior to 3.2.1 are vulnerable to regular expression denial of service (ReDoS) that may, under some circumstances, affect iTop server. Version 3.2.1 doesn't use the affected variable in the regular expression. As a workaround, if iTop app_root_url is defined in the configuration file, then there is no possible way to exploit this ReDoS.

References (1)

Core 1
Core References

Scores

CVSS v3 5.3
EPSS 0.0027
EPSS Percentile 17.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-1333
Status published
Products (1)
combodo/itop < 3.2.1
Published May 14, 2025
Tracked Since Feb 18, 2026