PT-2025-13685 · Ejbca · Ejbca

Published 2025-03-31 · Updated 2025-10-10 · CVE-2025-3026

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EJBCA version 8.0 Enterprise

Description The issue exists in the EJBCA service, where modifying the Host header in an HTTP request allows manipulation of generated links, potentially redirecting the client to a different base URL. This could enable an attacker to insert their own server, receiving HTTP requests from the client, if the issue is successfully exploited.

Recommendations For version 8.0 Enterprise, consider restricting modifications to the Host header in HTTP requests as a temporary mitigation measure until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BIT-EJBCA-2025-3026

CVE-2025-3026

Affected Products

Ejbca

References · 7

• https://osv.dev/vulnerability/CVE-2025-3026 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3026 · Security Note
• https://osv.dev/vulnerability/BIT-ejbca-2025-3026 · Vendor Advisory
• https://t.me/cveNotify/137985 · Telegram Post
• https://t.me/cvedetector/21583 · Telegram Post
• https://twitter.com/CVEnew/status/1906657535882621417 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ejbca · Note