CVE-2025-0970

Zenvia Movidesk Login redirect

State: Published
Severity: 6.9 Medium
Published: Feb 2, 2025
Updated: Feb 12, 2025
Reserved: Feb 2, 2025

Description

A vulnerability was found in Zenvia Movidesk up to 25.01.22. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /Account/Login. The manipulation of the argument ReturnUrl leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 25.01.22.245a473c54 is able to address this issue. It is recommended to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	VulDB
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	VulDB
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	VulDB
2.0	5.0 Medium	AV:N/AC:L/Au:N/C:N/I:P/A:N	VulDB

Weaknesses

CWE-601 Open Redirect

Affected Products

Product	Versions
MovideskZenvia	25.01.0Affected 25.01.1Affected 25.01.2Affected 25.01.3Affected 25.01.4Affected 25.01.5Affected 25.01.6Affected 25.01.7Affected 25.01.8Affected 25.01.9Affected 25.01.10Affected 25.01.11Affected 25.01.12Affected 25.01.13Affected 25.01.14Affected 25.01.15Affected 25.01.16Affected 25.01.17Affected 25.01.18Affected 25.01.19Affected 25.01.20Affected 25.01.21Affected 25.01.22Affected

References

VDB-294361 | Zenvia Movidesk Login redirectvdb-entrytechnical-description
VDB-294361 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #485985 | zenvia movidesk < 25.01.15.86c796efe6 Open Redirectthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.