« Volver al listado

CVE-2025-27632

Estado: AplazadaMedia (6.1)—

A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request to leverage multiple attack vectors, including defacing the site content through web-cache poisoning.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Trmtracker — TrmtrackerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-27632",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-27632",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-25T13:10:29.615743Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cybersecurity@hitachienergy.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cybersecurity@hitachienergy.com",
      "affectedData": [
        {
          "vendor": "Hitachi Energy",
          "product": "TRMTracker",
          "versions": [
            {
              "status": "affected",
              "version": "6.2",
              "versionType": "custom",
              "lessThanOrEqual": "6.2.04"
            },
            {
              "status": "affected",
              "version": "6.3",
              "versionType": "custom",
              "lessThanOrEqual": "6.3.01"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-03-25T13:15:41.090",
  "references": [
    {
      "url": "https://publisher.hitachienergy.com/preview?DocumentID=8DBD000210&LanguageCode=en&DocumentPartId=&Action=Launch",
      "source": "cybersecurity@hitachienergy.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cybersecurity@hitachienergy.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-644"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request to leverage multiple attack vectors, including defacing the site content through web-cache poisoning."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección de encabezado de host en la aplicación TRMTracker puede permitir que un atacante, al modificar el valor del encabezado de host en una solicitud HTTP, aproveche múltiples vectores de ataque, incluida la desfiguración del contenido del sitio mediante el envenenamiento de la caché web."
    }
  ],
  "lastModified": "2026-06-17T09:03:56.057",
  "sourceIdentifier": "cybersecurity@hitachienergy.com"
}