CVE-2025-27223
HighCVSS 7.5Exploitation Probability (EPSS)
High risk83th percentile - higher than 83% of all known CVEs
Summary
TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the application uses a static key to create the encrypted cookie, ultimately allowing anyone to forge cookies and gain access to sensitive internal information.
Risk Assessment
An attacker can impersonate an authenticated user and access sensitive internal organizational data. This represents a serious breach of access controls.
Recommendation
Update TRUfusion Enterprise to a version newer than 7.10.4.0 if available, or implement additional authentication mechanisms and restrict access to portal endpoints.
Other vulnerabilities in TRUfusion Enterprise
See all- CVE-2025-27225High
TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint discloses sensitive internal information, including PII, to unauthenticated attackers.
- CVE-2025-27224Critical
TRUfusion Enterprise through 7.10.4.0 does not properly sanitize input to the /trufusionPortal/fileupload endpoint, allowing path traversal sequences. This enables writing files with any filename and type to any location on the local server, ultimately leading to arbitrary code execution.
- CVE-2025-27222High
TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to read any local server file that is accessible by the TRUfusion user and can also be used to leak cleartext passwords of TRUfusion Enterprise itself.
Original NVD description (English source)
TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the application uses a static key to create the encrypted cookie, ultimately allowing anyone to forge cookies and gain access to sensitive internal information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS