CVE-2025-27225
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint discloses sensitive internal information, including PII, to unauthenticated attackers.
Risk Assessment
The vulnerability leads to leakage of personally identifiable information and internal data, potentially violating data protection regulations (e.g., GDPR) and increasing the risk of social engineering attacks.
Recommendation
Update TRUfusion Enterprise to a version later than 7.10.4.0 or apply the vendor patch; until then, block access to the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint.
Other vulnerabilities in TRUfusion Enterprise
See all- CVE-2025-27224Critical
TRUfusion Enterprise through 7.10.4.0 does not properly sanitize input to the /trufusionPortal/fileupload endpoint, allowing path traversal sequences. This enables writing files with any filename and type to any location on the local server, ultimately leading to arbitrary code execution.
- CVE-2025-27223High
TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the application uses a static key to create the encrypted cookie, ultimately allowing anyone to forge cookies and gain access to sensitive internal information.
- CVE-2025-27222High
TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to read any local server file that is accessible by the TRUfusion user and can also be used to leak cleartext passwords of TRUfusion Enterprise itself.
Original NVD description (English source)
TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint discloses sensitive internal information including PII to unauthenticated attackers.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS