CVE-2025-55462
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response with Access-Control-Allow-Credentials: true. This enables malicious third-party websites to perform authenticated cross-origin requests against the Eramba API, including endpoints like /system-api/login and /system-api/user/me, exposing sensitive user session data.
Risk Assessment
The risk includes full session hijack and exfiltration of user credentials and personal data (ID, name, email, access groups) without user interaction, potentially leading to unauthorized system access.
Recommendation
Immediately upgrade Eramba to version 3.23.3 or earlier, which is not affected, or apply a vendor patch. Additionally, configure the web server to strictly restrict allowed Origin headers.
Original NVD description (English source)
A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response along with Access-Control-Allow-Credentials: true. This permits malicious third-party websites to perform authenticated cross-origin requests against the Eramba API, including endpoints like /system-api/login and /system-api/user/me. The response includes sensitive user session data (ID, name, email, access groups), which is accessible to the attacker's JavaScript. This flaw enables full session hijack and data exfiltration without user interaction. Eramba versions 3.23.3 and earlier were tested and appear unaffected. The vulnerability is present in default installations, requiring no custom configuration.