HIGH🇵🇱 Wersja polska

CVE-2025-27223

CVSS 7.5v3.1pub. 2025-10-27upd. 2025-10-31

TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the application uses a static key to create the encrypted cookie, ultimately allowing anyone to forge cookies and gain access to sensitive internal information.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Rocketsoftware Trufusion Enterprise

    APP
    Rocketsoftware
    ≤ 7.10.4.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-59793CRITICAL9.4PL ✓ten sam produkt

Path traversal umożliwiający RCE w Rocket TRUfusion Enterprise

CVE-2025-27224CRITICAL9.8PL ✓ten sam produkt

Path Traversal w Rocket TRUfusion Enterprise – zapis dowolnych plików i RCE

CVE-2025-32355HIGH7.9ten sam produkt

Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections. However, the...

CVE-2025-27222HIGH8.6ten sam produkt

TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. ...

CVE-2025-27225HIGH7.5ten sam produkt

TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoi...