CVE-2025-27139

moderate-risk
Published 2025-02-25

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.12, 3.1.2, and 3.2.0 are vulnerable to cross-site scripting when the preferences page is opened. Versions 2.7.12, 3.1.2, and 3.2.0 fix the issue.

Do I need to act?

~
1.0% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.8/10 Medium
NETWORK / LOW complexity

Affected Products (6)

Affected Vendors

Combodo

References (1)

Vendor Advisory https://github.com/Combodo/iTop/security/advisories/GHSA-c6mg-9537-c8cf
41
/ 100
moderate-risk
Severity 25/34 · High
Exploitability 3/34 · Minimal
Exposure 13/34 · Low