CVE-2025-27223
Rocketsoftware Trufusion Enterprise ≤ 7.10.4.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2025-27223 is a high-severity Sensitive Cookie Without 'HttpOnly' Flag (CWE-1004) vulnerability in Rocketsoftware Trufusion Enterprise. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Steal Web Session Cookie (T1539); ranked in the top 20% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-23 (Session Authenticity) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
TRUfusion Enterprise through version 7.10.4.0 uses an encrypted COOKIEID value as an authentication token for endpoints including /trufusionPortal/getProjectList. The application derives this token from a static encryption key, which permits straightforward forgery of valid cookies without knowledge of any user credentials or session secrets. The flaw is tracked as CVE-2025-27223 and carries a CVSS 3.1 score of 7.5.
An unauthenticated attacker with network access can craft a COOKIEID using the known static key and submit it to the affected endpoints. Successful exploitation grants read access to sensitive internal project and configuration data while requiring no privileges or user interaction.
Public advisories published alongside the CVE, including a detailed technical report and a vendor product page, document the issue but do not yet reference an official patch or configuration workaround. The associated EPSS score rose from a low baseline to a peak of 0.0892 before settling at 0.0551, indicating measurable post-disclosure exploitation interest.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-36214
Vulnerability Data
TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the application uses a static key to create the encrypted cookie, ultimately allowing anyone to forge cookies and gain access to…
more
sensitive internal information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Proper implementation of session authenticity requires marking sensitive session cookies HttpOnly so that client scripts cannot access them.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Broad SDLC practices catch cookie-handling defects via standards/testing (mostly forward) yet remain too general to guarantee this narrow flag setting is always enforced (partial reverse).
Role-based training can reduce the chance developers introduce missing HttpOnly flags but supplies no enforcement or detection, leaving essentially all of the implementation flaw's risk intact.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing HttpOnly flags but does not prevent the weakness.
Application security requirements can mandate HttpOnly on sensitive cookies.
Secure coding standards explicitly require the HttpOnly flag for sensitive cookies.