CVE-2025-4673

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jun 11, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-467306.5MobSF is a mobile application security testing tool used. Typically, MobSF is deployed on centralized internal or cloud-based servers that aCVE-2025-467317.2Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 containCVE-2025-467325.4OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.6.6, an IDOR vulneraCVE-2025-467337.9OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the CVE-2025-467346.4league/commonmark is a PHP Markdown parser. A cross-site scripting (XSS) vulnerability in the Attributes extension of the league/commonmark CVE-2025-467351.1Terraform WinDNS Provider allows users to manage their Windows DNS server resources through Terraform. A security issue has been found in TeCVE-2025-467365.3Umbraco is a free and open source .NET content management system. Prior to versions 10.8.10 and 13.8.1, based on an analysis of the timing oCVE-2025-467377.4SEL-5037 Grid Configurator contains an overly permissive Cross Origin Resource Sharing (CORS) configuration for a data gateway service in thCVE-2025-467386.6An authenticated attacker can maliciously modify layout data files in the SEL-5033 installation directory to execute arbitrary code.CVE-2025-467398.1An unauthenticated user could discover account credentials via a brute-force attack without rate limitingCVE-2025-46748.6The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuCVE-2025-467407.5An authenticated user without user administrative permissions could change the administrator Account Name.
CVE-2025-4673: Medium severity, CVSS 6.8 | Vulnix