CVE-2025-27632

MEDIUM6.1

A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request to leverage multiple attack vectors, including defacing the site content through web-cache poisoning

Published Mar 25, 2025

Modified 4 months ago

Details

A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request to leverage multiple attack vectors, including defacing the site content through web-cache poisoning.

References

ADVISORY

https://publisher.hitachienergy.com/preview?DocumentID=8DBD000210&LanguageCode=en&DocumentPartId=&Action=Launch

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2025-27632

CVSS Analysis

CVSS v3.1

6.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

ChangedS:C

Impact

Confidentiality

LowC:L

Integrity

LowI:L

Availability

NoneA:N

6.1/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness Type (CWE)

Other

CWE-644

Ecosystems

Timeline

PublishedMar 25, 2025

ModifiedOct 24, 2025