PT-2025-20365 · Halo · Halo

Published 2025-05-08 · Updated 2025-05-09 · CVE-2025-40846

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:H/SA:H/S:P/AU:Y/R:U/RE:L/U:Red

Name of the Vulnerable Software and Affected Versions Halo versions up to 2.174.101 Halo versions 2.175.1 through 2.184.21

Description The issue is related to improper input validation, specifically with the returnUrl parameter in Account Security Settings. This lack of validation allows attackers to redirect users to malicious websites (open redirect) and inject JavaScript code to perform cross-site scripting attacks.

Recommendations For Halo versions up to 2.174.101, update to a version that includes proper input validation for the returnUrl parameter. For Halo versions 2.175.1 through 2.184.21, update to a version that includes proper input validation for the returnUrl parameter. As a temporary workaround, consider restricting access to the returnUrl parameter in the Account Security Settings to minimize the risk of exploitation.

Fix

Open Redirect

RCE

Weakness Enumeration

CWE-601

CWE-20

Related Identifiers

CVE-2025-40846

Affected Products

Halo

References · 9

• https://support.haloservicedesk.com/kb?id=2501 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40846 · Security Note
• https://twitter.com/CVEnew/status/1920416035968332023 · Twitter Post
• https://t.me/cvenotify/121323 · Telegram Post
• https://twitter.com/threatsbank/status/1920856779153408091 · Twitter Post
• https://t.me/cvetracker/23345 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1920500564355325987 · Twitter Post
• https://t.me/latest_high_impact_cve/2301 · Telegram Post
• https://t.me/cvedetector/24815 · Telegram Post