Yüksek CVSS 7.5 PoC var
CVE-2025-27223: Trufusion Enterprise: güvenlik açığı
Açıklama (NVD)
TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the application uses a static key to create the encrypted cookie, ultimately allowing anyone to forge cookies and gain access to sensitive internal information.
Özet bilgiler
- Ürün
- Rocketsoftware Trufusion Enterprise
- CVSS v3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS
- %2,20 (yüzdelik 83)
- CWE
- CWE-1004
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| rocketsoftware-trufusion-enterprise | — | 7.10.4.0 | — |