CVE-2025-58044 | THREATINT

Description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability. This vulnerability is fixed in v3.10.19 and v4.10.5.

PUBLISHED Reserved 2025-08-22 | Published 2025-12-01 | Updated 2025-12-01 | Assigner GitHub_M

MEDIUM: 5.5CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:P

Problem types

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

Product status

< 3.10.19

affected

>= 4.0.0, < 4.10.5

affected

References

github.com/...server/security/advisories/GHSA-h762-mj7p-jwjq

github.com/...ommit/36ae076cb021f16d2053a63651bc16d15a3ed53b

cve.org (CVE-2025-58044)

nvd.nist.gov (CVE-2025-58044)

Download JSON