CVE-2025-27223: High severity TRUfusion Enterprise vulnerability
TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the application uses a static key to create the encrypted cookie, ultimately allowing anyone to forge cookies and gain access to sensitive internal information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27223?
CVE-2025-27223 has a high severity rating due to its potential for unauthorized access to sensitive endpoints.
How do I fix CVE-2025-27223?
To mitigate CVE-2025-27223, upgrade TRUfusion Enterprise to version 7.10.4.1 or later where the static key generation issue is addressed.
What are the potential risks of CVE-2025-27223?
The risks of CVE-2025-27223 include unauthorized access to project lists and other data, compromising application confidentiality and integrity.
Which versions of TRUfusion Enterprise are affected by CVE-2025-27223?
CVE-2025-27223 affects all versions of TRUfusion Enterprise up to and including 7.10.4.0.
What does CVE-2025-27223 expose in TRUfusion Enterprise?
CVE-2025-27223 exposes the COOKIEID used for authentication, allowing attackers to forge cookies and gain unauthorized access.