PT-2023-12776 · Rocket · Rocket Trufusion Portal

Published 2023-01-12 · Updated 2025-04-08 · CVE-2022-25027

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rocket TRUfusion Portal version 7.9.2.1

Description The issue concerns the Forgotten Password functionality, which allows remote attackers to bypass authentication. This is achieved by validating the user's session token when the "Password forgotten?" button is clicked, enabling access to restricted pages.

Recommendations For Rocket TRUfusion Portal version 7.9.2.1, consider disabling the Forgotten Password functionality as a temporary workaround until a patch is available. Restrict access to restricted pages to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-640

CWE-287

Related Identifiers

CVE-2022-25027

Affected Products

Rocket Trufusion Portal

References · 5

• https://osv.dev/vulnerability/CVE-2022-25027 · Vendor Advisory
• https://labs.nettitude.com/blog/cve-2022-25026-cve-2022-25027-vulnerabilities-in-rocket-trufusion-enterprise · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-25027 · Security Note
• https://t.me/cvenotify/118230 · Telegram Post
• https://t.me/cvenotify/118231 · Telegram Post