PT-2025-29920 · Unknown · Diracx-Web

Robin-Van-De-Merghel · Published 2025-07-17 · Updated 2025-07-17 · CVE-2025-54066

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions DiracX-Web versions prior to 0.1.0-a8

Description DiracX-Web is a web application that provides an interface to interact with the DiracX services. An attacker can forge a request to redirect an authenticated user to an arbitrary website. The application’s redirect field on the login page is not verified and is susceptible to parameter pollution, allowing an attacker to hide a malicious URI. This could be used for phishing and credential theft.

Recommendations Update to version 0.1.0-a8 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-54066

GHSA-HFJ7-542Q-8FVV

Affected Products

Diracx-Web

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54066.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-54066 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54066 · Security Note
• https://osv.dev/vulnerability/GHSA-hfj7-542q-8fvv · Vendor Advisory
• https://github.com/DIRACGrid/diracx-web · Note
• https://github.com/DIRACGrid/diracx-web/commit/eba3b7bc4f9d394074215986e6d3c15b546b25d5 · Note
• https://github.com/DIRACGrid/diracx-web/security/advisories/GHSA-hfj7-542q-8fvv · Note
• https://t.me/cvetracker/28042 · Telegram Post
• https://twitter.com/CVEnew/status/1945865594613473523 · Twitter Post
• https://diracx-cert.app.cern.ch/auth?redirect=https://ipcim.com/en/where/?dsdsd=qsqsfsjfnsfniizaeiaapzqlalkqkaizqqijsjaopmqmxna?redirect=https://diracx-cert-app.cern.ch/auth · Note