PT-2025-20603 · Retool · Retool

Published 2025-05-09 · Updated 2025-05-10 · CVE-2025-47424

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Retool (self-hosted) versions prior to 3.196.0

Description The issue allows for Host header injection when the BASE DOMAIN environment variable is not set, enabling manipulation of the HTTP host header.

Recommendations For versions prior to 3.196.0, update to version 3.196.0 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-348

Related Identifiers

CVE-2025-47424

Affected Products

Retool

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-47424 · Security Note
• https://t.me/cvenotify/121620 · Telegram Post
• https://docs.retool.com/disclosures/cve-2025-47424 · Note
• https://t.me/cvetracker/23523 · Telegram Post
• https://twitter.com/cybercronai/status/1921212469919248535 · Twitter Post
• https://t.me/cvedetector/24986 · Telegram Post
• https://t.me/cvenotify/121619 · Telegram Post
• https://twitter.com/cybercronai/status/1921256577345978752 · Twitter Post