CVE-2025-12874 MEDIUM

CVE-2025-12874: HTTP Request Smuggling in Quest Coexistence Manager for Notes

Vendor Quest
Product Coexistence Manager for Notes
Weakness CWE-444
Published December 19, 2025
Last update December 19, 2025
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/U:Clear

What the vulnerability does

01Description

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Quest Coexistence Manager for Notes (Free/Busy Connector modules) allows HTTP Request Smuggling via the Content-Length-Transfer-Encoding (CL.TE) attack vector. This could allow an attacker to bypass access controls, poison web caches, hijack sessions, or trigger unintended internal requests. This issue affects Coexistence Manager for Notes 3.8.2045. Other versions may also be affected.

Key dates

02Disclosure timeline

December 19, 2025 CVE published
December 19, 2025 Record updated