CVE-2025-7863

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-7863

3.5 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

A

vulnerability was found in thinkgem JeeSite up to 5.12.0 and classified as problematic. Affected by this issue is the function redirectUrl of the file src/main/java/com/jeesite/common/web/http/ServletUtils.java. The manipulation of the argument url leads to open redirect. The attack may be launched remotely. The name of the patch is 3d06b8d009d0267f0255acc87ea19d29d07cedc3. It is recommended to apply a patch to fix this issue.

References
Link Resource
https://github.com/thinkgem/jeesite5/commit/3d06b8d009d0267f0255acc87ea19d29d07cedc3 Patch
https://github.com/thinkgem/jeesite5/issues/30 Exploit Issue Tracking
https://github.com/thinkgem/jeesite5/issues/30#issuecomment-3045861920 Issue Tracking
https://vuldb.com/?ctiid.316976 Permissions Required VDB Entry
https://vuldb.com/?id.316976 Third Party Advisory VDB Entry
https://vuldb.com/?submit.618188 Third Party Advisory VDB Entry
https://github.com/thinkgem/jeesite5/issues/30 Exploit Issue Tracking
https://github.com/thinkgem/jeesite5/issues/30#issuecomment-3045861920 Issue Tracking
Configurations

Configuration 1 (hide)

cpe:2.3:a:jeesite:jeesite:*:*:*:*:*:*:*:*
History

25 Aug 2025, 17:06

Type Values Removed Values Added
CPE cpe:2.3:a:jeesite:jeesite:*:*:*:*:*:*:*:*
First Time Jeesite
Jeesite jeesite
References () https://github.com/thinkgem/jeesite5/commit/3d06b8d009d0267f0255acc87ea19d29d07cedc3 - () https://github.com/thinkgem/jeesite5/commit/3d06b8d009d0267f0255acc87ea19d29d07cedc3 - Patch
References () https://github.com/thinkgem/jeesite5/issues/30 - () https://github.com/thinkgem/jeesite5/issues/30 - Exploit, Issue Tracking
References () https://github.com/thinkgem/jeesite5/issues/30#issuecomment-3045861920 - () https://github.com/thinkgem/jeesite5/issues/30#issuecomment-3045861920 - Issue Tracking
References () https://vuldb.com/?ctiid.316976 - () https://vuldb.com/?ctiid.316976 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.316976 - () https://vuldb.com/?id.316976 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.618188 - () https://vuldb.com/?submit.618188 - Third Party Advisory, VDB Entry

22 Jul 2025, 15:15

Type Values Removed Values Added
References () https://github.com/thinkgem/jeesite5/issues/30 - () https://github.com/thinkgem/jeesite5/issues/30 -
References () https://github.com/thinkgem/jeesite5/issues/30#issuecomment-3045861920 - () https://github.com/thinkgem/jeesite5/issues/30#issuecomment-3045861920 -

22 Jul 2025, 13:06

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad en thinkgem JeeSite hasta la versión 5.12.0 y se clasificó como problemática. Este problema afecta a la función redirectUrl del archivo src/main/java/com/jeesite/common/web/http/ServletUtils.java. La manipulación del argumento url provoca una redirección abierta. El ataque puede ejecutarse en remoto. El parche se llama 3d06b8d009d0267f0255acc87ea19d29d07cedc3. Se recomienda aplicar un parche para solucionar este problema.

20 Jul 2025, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-20 03:15

Updated : 2025-08-25 17:06

NVD link : CVE-2025-7863

Mitre link : CVE-2025-7863

CVE.ORG link : CVE-2025-7863

JSON object : View

Products Affected

jeesite

CWE
CWE-601

URL Redirection to Untrusted Site ('Open Redirect')