PT-2025-13686 · Ejbca · Ejbca

Published 2025-03-31 · Updated 2025-10-10 · CVE-2025-3027

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EJBCA version 8.0 Enterprise

Description The issue exists in the EJBCA service, where a small change to the PATH of the URL associated with the service causes the server to fail in finding the requested file, resulting in a redirect to an external page. This could allow users to be redirected to potentially malicious external sites, which can be exploited for phishing or other social engineering attacks.

Recommendations For EJBCA version 8.0 Enterprise, consider restricting access to external redirects until a patch is available. As a temporary workaround, review and validate all URL paths associated with the EJBCA service to prevent unauthorized redirects.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BIT-EJBCA-2025-3027

CVE-2025-3027

Affected Products

Ejbca

References · 8

• https://osv.dev/vulnerability/CVE-2025-3027 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-ejbca-2025-3027 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3027 · Security Note
• https://t.me/cvedetector/21584 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1906673399042019494 · Twitter Post
• https://twitter.com/CVEnew/status/1906657533957394498 · Twitter Post
• https://t.me/cveNotify/137986 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ejbca · Note