CVE-2025-7763
thinkgem JeeSite Site Controller SiteController.java select redirect
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 17, 2025
- Updated
- Jul 18, 2025
- Reserved
- Jul 17, 2025
Description
A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0. Affected is the function select of the file src/main/java/com/jeesite/modules/cms/web/SiteController.java of the component Site Controller. The manipulation of the argument redirect leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 3d06b8d009d0267f0255acc87ea19d29d07cedc3. It is recommended to apply a patch to fix this issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C | VulDB |
| 2.0 | 5.0 Medium | AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C | VulDB |
Weaknesses
- CWE-601 Open Redirect
Affected Products
| Product | Versions |
|---|---|
JeeSitethinkgem |
|
References
- VDB-316758 | thinkgem JeeSite Site Controller SiteController.java select redirectvdb-entrytechnical-description
- VDB-316758 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #616103 | JeeSite https://github.com/thinkgem/jeesite5 <=5.12.0 Open Redirectthird-party-advisory
- https://github.com/thinkgem/jeesite5/issues/28exploitissue-tracking
- https://github.com/thinkgem/jeesite5/issues/28#issuecomment-3045862239issue-tracking
- https://github.com/thinkgem/jeesite5/commit/3d06b8d009d0267f0255acc87ea19d29d07cedc3patch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.