PT-2025-48546 · Unknown · Jumpserver

Published 2025-12-01 · Updated 2026-03-26 · CVE-2025-58044

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions JumpServer versions prior to 3.10.19 JumpServer versions prior to 4.10.5

Description JumpServer is an open source bastion host and an operation and maintenance security audit system. The /core/i18n// API endpoint uses the Referer header as the redirection target without proper validation. This can lead to an Open Redirect condition, potentially allowing an attacker to redirect users to malicious websites. The Referer header is used to determine the redirection target.

Recommendations JumpServer versions prior to 3.10.19 should be updated to version 3.10.19 or later. JumpServer versions prior to 4.10.5 should be updated to version 4.10.5 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-58044

GHSA-H762-MJ7P-JWJQ

Affected Products

Jumpserver

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58044.json · Exploit
• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-h762-mj7p-jwjq · Vendor Advisory
• https://github.com/jumpserver/jumpserver/commit/36ae076cb021f16d2053a63651bc16d15a3ed53b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-58044 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58044 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1995724823054459025 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/2036971431603691662 · Twitter Post
• https://twitter.com/CVEnew/status/1995596448709095812 · Twitter Post
• https://t.me/CVEtracker/38581 · Telegram Post
• https://t.me/cveNotify/144937 · Telegram Post