PT-2025-21568 · Horilla · Horilla

Saharshtapi · Publicado 2025-05-15 · Atualizado 2025-05-15 · CVE-2025-47789

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Horilla versions prior to 1.3

Description: Horilla is a free and open source Human Resource Management System (HRMS). In affected versions, an attacker can manipulate a Horilla URL to refer to an external domain. Upon clicking and logging in, the user is redirected to this external domain, allowing redirection to any arbitrary site, including phishing or malicious domains. This can be used to impersonate Horilla and trick users.

Recommendations: For versions prior to 1.3, update to a version that includes the fix commit 1c72404df6888bb23af73c767fdaee5e6679ebd6 to resolve the issue. As a temporary workaround, consider restricting access to external domains from within Horilla to minimize the risk of exploitation.

Exploit

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2025-47789

GHSA-CQP5-XX4J-R468

Produtos afetados

Horilla

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47789.json · Exploit
• https://github.com/horilla-opensource/horilla/security/advisories/GHSA-cqp5-xx4j-r468 · Correção
• https://github.com/horilla-opensource/horilla/commit/1c72404df6888bb23af73c767fdaee5e6679ebd6 · Correção
• https://osv.dev/vulnerability/CVE-2025-47789 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-47789 · Nota de Segurança
• https://twitter.com/CVEnew/status/1923110480182227265 · Publicação no Twitter
• https://t.me/cvetracker/23944 · Publicação no Telegram