BIT-ejbca-2025-3026
Dashboard / Vulnerabilities / BIT-ejbca-2025-3026
Summary: Improper Neutralization of Special Elements vulnerability in EJBCA
Details: The vulnerability exists in the EJBCA service, version 8.0 Enterprise. Not tested in higher versions. By modifying the ‘Host’ header in an HTTP request, it is possible to manipulate the generated links and thus redirect the client to a different base URL. In this way, an attacker could insert his own server for the client to send HTTP requests, provided he succeeds in exploiting it.
References: https://nvd.nist.gov/vuln/detail/CVE-2025-3026, https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ejbca
Affected packages
Package
Name: ejbca
Purl: pkg:bitnami/ejbca
Affected ranges
Type: SEMVER
Events:
Introduced- 8.0.0
Fixed -9.1.0
Affected versions
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
