CVE-2025-9193

TOTVS Portal Meu RH Password Reset redirect

State: Published
Severity: 5.1 Medium
Published: Aug 20, 2025
Updated: Aug 22, 2025
Reserved: Aug 19, 2025

Description

A flaw has been found in TOTVS Portal Meu RH up to 12.1.17. Impacted is an unknown function of the component Password Reset Handler. Executing manipulation of the argument redirectUrl can lead to open redirect. The attack may be performed from a remote location. The exploit has been published and may be used. Upgrading to version 12.1.2410.274, 12.1.2502.178 and 12.1.2506.121 is recommended to address this issue. It is recommended to upgrade the affected component. The vendor explains, that "[o]ur internal validation (...) confirms that the reported behavior does not exist in currently supported releases. In these tests, the redirectUrl parameter is ignored, and no malicious redirection occurs." This vulnerability only affects products that are no longer supported by the maintainer.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	3.5 Low	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
3.0	3.5 Low	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
2.0	4.0 Medium	AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-601 Open Redirect

Affected Products

Product	Versions
Portal Meu RHTOTVS	12.1.0Affected 12.1.1Affected 12.1.2Affected 12.1.3Affected 12.1.4Affected 12.1.5Affected 12.1.6Affected 12.1.7Affected 12.1.8Affected 12.1.9Affected 12.1.10Affected 12.1.11Affected 12.1.12Affected 12.1.13Affected 12.1.14Affected 12.1.15Affected 12.1.16Affected 12.1.17Affected 12.1.2410.274Not affected 12.1.2502.178Not affected 12.1.2506.121Not affected

References

VDB-320579 | TOTVS Portal Meu RH Password Reset redirectvdb-entrytechnical-description
VDB-320579 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #636360 | TOTVS Portal Meu RH 12.1.17 Open Redirect combined with phishing in password resetthird-party-advisory
https://drive.google.com/file/d/1iorjSJ8gh3hTDZUy1fHyV-TJXFP43yIo/view?usp=sharingbroken-linkexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.