Vulnerability · Published Mar 31, 2025 · Assigned by INCIBE
CVE-2025-3026Improper Neutralization of Special Elements vulnerability in EJBCA
Medium 5.1
In plain English
A medium-severity injection in EJBCA from PrimeKey Solutions AB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Official description
The vulnerability exists in the EJBCA service, version 8.0 Enterprise. Not tested in higher versions. By modifying the ‘Host’ header in an HTTP request, it is possible to manipulate the generated links and thus redirect the client to a different base URL. In this way, an attacker could insert his own server for the client to send HTTP requests, provided he succeeds in exploiting it.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PrimeKey Solutions AB | EJBCA | 8.0 |
Weakness: CWE-74 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N