CVE-2025-27225

概要

参考情報

• MrTuxracer/advisories · Exploit
• rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise · Exploit
• rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise · Product

trufusion enterprise のその他の脆弱性

• CVE-2025-32355高 7.3Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections. However, the proxy is misconfigured in a w…
• CVE-2025-59793緊急 9.9Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able…
• CVE-2025-27224緊急 9.8TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files. However, the application doesn't proper…
• CVE-2025-27223高 7.5TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPor…
• CVE-2025-27222高 8.6TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn…