CVE-2025-58044CWE-601

CVE-2025-58044

Medium · published December 2, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
41.1
In the wild
Unconfirmed
What it is

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability. This vulnerability is fixed in v3.10.19 and v4.10.5.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00488 · 41.1th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2025-12-02T02:15Z
Affected products (2)
ProductVersionsFixed in
fit2cloud/jumpserver< 3.10.193.10.19
fit2cloud/jumpserver≥ 4.0.0, < 4.10.54.10.5
References (2)
https://github.com/jumpserver/jumpserver/commit/36ae076cb021f16d2053a63651bc16d15a3ed53b · [email protected]https://github.com/jumpserver/jumpserver/security/advisories/GHSA-h762-mj7p-jwjq · [email protected]
EPSS history
Timeline
  • 01 DEC 20:17Z
    JumpServer has an Open Redirect Vulnerability
    cvelistv5