What is CVE-2025-3027?

CVE-2025-3027 is a medium-severity vulnerability in Primekey Ejbca, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 6.1/10. Published 2025-03-31.

How severe is CVE-2025-3027?

Medium severity. CVSS v3 base score is 6.1 out of 10.

Open Redirect in Primekey Ejbca

CVE-2025-3027

The vulnerability exists in the EJBCA service, version 8.0 Enterprise. By making a small change to the PATH of the URL associated with the service, the server fails to find the requested file and redirects to an external page. This vulnerability could allow users to be redirected to potentially malicious external sites, which can be exploited for phishing or other social engineering attacks.

Vulnerability class: Open Redirect

EPSS: 0.002 (10.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Primekey Ejbca
Primekey Solutions Ab Ejbca — versions 8.0

Weakness classification (CWE)

CWE-601 — URL Redirection to Untrusted Site (Open Redirect)

References

cve-coordination@incibe.es (Third Party Advisory)

Frequently asked questions

What is CVE-2025-3027?: CVE-2025-3027 is a medium-severity vulnerability in Primekey Ejbca, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 6.1/10. Published 2025-03-31.
How severe is CVE-2025-3027?: Medium severity. CVSS v3 base score is 6.1 out of 10.