CVE-2025-47424: High severity retool vulnerability
Published May 9, 2025
·Updated
Retool (self-hosted) before 3.196.0 allows Host header injection. When the BASEDOMAIN environment variable is not set, the HTTP host header can be manipulated.
Affected Software
1 affected component
Retool Retool<3.196.0
Event History
May 9, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:15 PM
DescriptionSeverityWeakness
Apr 16, 57340
Event
via FIRST·02:29 AM
Frequently Asked Questions
1
What is the severity of CVE-2025-47424?
CVE-2025-47424 has a medium severity level due to the potential for host header injection.
2
How do I fix CVE-2025-47424?
To fix CVE-2025-47424, ensure that the BASE_DOMAIN environment variable is correctly set in your Retool configuration.
3
What software versions are affected by CVE-2025-47424?
CVE-2025-47424 affects Retool versions prior to 3.196.0.
4
What type of attack can occur due to CVE-2025-47424?
CVE-2025-47424 allows for host header injection, which could result in redirection attacks or other types of exploitation.
5
Is CVE-2025-47424 easy to exploit?
CVE-2025-47424 can be relatively easy to exploit if the BASE_DOMAIN is not set, allowing attackers to manipulate the HTTP host header.