CVE-2025-7785
thinkgem JeeSite SsoController.java sso redirect
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 18, 2025
- Updated
- Jul 18, 2025
- Reserved
- Jul 18, 2025
Description
A vulnerability classified as problematic was found in thinkgem JeeSite up to 5.12.0. This vulnerability affects the function sso of the file src/main/java/com/jeesite/modules/sys/web/SsoController.java. The manipulation of the argument redirect leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 3d06b8d009d0267f0255acc87ea19d29d07cedc3. It is recommended to apply a patch to fix this issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C | VulDB |
| 2.0 | 5.0 Medium | AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C | VulDB |
Weaknesses
- CWE-601 Open Redirect
Affected Products
| Product | Versions |
|---|---|
JeeSitethinkgem |
|
References
- VDB-316846 | thinkgem JeeSite SsoController.java sso redirectvdb-entrytechnical-description
- VDB-316846 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #616104 | JeeSite https://github.com/thinkgem/jeesite5 <=5.12.0 Open Redirectthird-party-advisory
- https://github.com/thinkgem/jeesite5/issues/29issue-tracking
- https://github.com/thinkgem/jeesite5/issues/29#issuecomment-3045862084issue-tracking
- https://github.com/thinkgem/jeesite5/issues/29#issue-3209433725exploitissue-tracking
- https://github.com/thinkgem/jeesite5/commit/3d06b8d009d0267f0255acc87ea19d29d07cedc3patch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.