PT-2025-21568 · Horilla · Horilla

Saharshtapi · Published 2025-05-15 · Updated 2025-05-15 · CVE-2025-47789

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Horilla versions prior to 1.3

Description: Horilla is a free and open source Human Resource Management System (HRMS). In affected versions, an attacker can manipulate a Horilla URL to refer to an external domain. Upon clicking and logging in, the user is redirected to this external domain, allowing redirection to any arbitrary site, including phishing or malicious domains. This can be used to impersonate Horilla and trick users.

Recommendations: For versions prior to 1.3, update to a version that includes the fix commit 1c72404df6888bb23af73c767fdaee5e6679ebd6 to resolve the issue. As a temporary workaround, consider restricting access to external domains from within Horilla to minimize the risk of exploitation.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-47789

GHSA-CQP5-XX4J-R468

Affected Products

Horilla

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47789.json · Exploit
• https://github.com/horilla-opensource/horilla/security/advisories/GHSA-cqp5-xx4j-r468 · Patch
• https://github.com/horilla-opensource/horilla/commit/1c72404df6888bb23af73c767fdaee5e6679ebd6 · Patch
• https://osv.dev/vulnerability/CVE-2025-47789 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47789 · Security Note
• https://twitter.com/CVEnew/status/1923110480182227265 · Twitter Post
• https://t.me/cvetracker/23944 · Telegram Post