CVE-2025-27223

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the application uses a static key to create the encrypted cookie, ultimately allowing anyone to forge cookies and gain access to sensitive internal information.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-1004

Affected software

No affected versions have been published.

Timeline

Published: Oct 27, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-272249.8TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files. However, the application doesn't proper CVE-2025-272257.5TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. T CVE-2025-272314.9The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP se CVE-2025-272324.9An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential c CVE-2025-272335.7Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments int CVE-2025-272347.3Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments int CVE-2025-272366.5A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This CVE-2025-272377.3In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing mali CVE-2025-272383.5Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to the CVE-2025-272407.2A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.CVE-2025-272415.5in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.CVE-2025-272425.5in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input.