The word 'sniffed' in this CVE description is a diagnostic signal you should not ignore. It tells you this is likely not a missing authorization check—one would read as 'unauthorized access to file retrieval.' Instead, 'sniffed' signals discoverability or guessability as the attack vector. That points to URL obfuscation as the attempted mitigation, not real access control. Ask whether version 3.2.3 implements per-file ownership verification, permission checks against the user session, or merely replaces predictable filenames with UUIDs. The latter is not a security fix; it's a speed bump that will be bypassed.
The CVSS 7.5 rating misrepresents the actual risk. iTop stores ITSM documents—incident records, change documentation, configuration exports—routinely containing credentials, network diagrams, and privileged access information. The blast radius extends from 'information disclosure' to 'infrastructure compromise' if even one credentials document or VPN configuration export is among the accessible files.
If you run a shared multi-tenant iTop deployment, treat this as a compliance catastrophe, not a 7.5. Cross-tenant file access in a SaaS topology isn't just a vulnerability—it triggers breach notification under GDPR and violates SOC 2 access control mandates. Obfuscated URLs that still permit cross-tenant enumeration aren't inadequate engineering; they're an admission of failure.
One more dimension the CVE doesn't capture: temporal exposure. ITSM tools retain every document ever attached to any ticket. If 3.2.3 only secures new uploads, every file uploaded before the fix remains accessible via URLs already logged in server records, browser caches, email threads, and backup tapes. The CVE publication itself teaches attackers exactly what document types to target. Your priority is determining whether legacy URLs still resolve, and if so, rotating any credentials or sensitive data that may have been uploaded during the exposure window.