Open Redirect in Primekey Ejbca
CVE-2025-3027
The vulnerability exists in the EJBCA service, version 8.0 Enterprise. By making a small change to the PATH of the URL associated with the service, the server fails to find the requested file and redirects to an external page. This vulnerability could allow users to be redirected to potentially malicious external sites, which can be exploited for phishing or other social engineering attacks.
Vulnerability class: Open Redirect
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (10.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 10th percentile — 10.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Primekey Ejbca
- Primekey Solutions Ab Ejbca — versions 8.0
Weakness classification (CWE)
References
- www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ejbca (Third Party Advisory)
Frequently asked questions
- What is CVE-2025-3027?
- CVE-2025-3027 is a medium-severity vulnerability in Primekey Ejbca, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 6.1/10. Published 2025-03-31.
- How severe is CVE-2025-3027?
- Medium severity. CVSS v3 base score is 6.1 out of 10.