CNNVD-202507-2536 Information
CNNVD ID
CNNVD-202507-2536
Related CVE
- CNNVD Published: 2025-07-20
Description (Chinese)
Thinkgem JeeSite是中国卓源（Thinkgem）公司的一套开源的Java EE企业级快速开发平台。该平台包括系统权限组件、数据权限组件、数据字典组件、核心工具组件、视图操作组件、工作流组件和代码生成组件等。 thinkgem JeeSite 5.12.0及之前版本存在输入验证错误漏洞，该漏洞源于文件ServletUtils.java中redirectUrl函数对参数url处理不当导致开放重定向。
Description (English)
Thinkgem JeeSite is an open-source version of the Java EE enterprise-level rapid development platform of Thinkgem, China. The platform includes the system rights component, the data rights component, the data dictionary component, the core tool component, the view operation component, the workflow component and the code generation component. Thinkgem JeeSite 5.12.0 & previous versions have input validation error holes, which stem from the fact that the url function of redirecturl in file ServletUtils.java does not properly handle the parameter url.
Hazard Level
Critical
Vulnerability Type
输入验证错误
Affected Vendor
卓源
Published
2025-07-20
Last Modified
2026-02-24
References
https://vuldb.com/?submit.618188 https://github.com/thinkgem/jeesite5/issues/30#issuecomment-3045861920 https://github.com/thinkgem/jeesite5/commit/3d06b8d009d0267f0255acc87ea19d29d07cedc3 https://vuldb.com/?id.316976 https://vuldb.com/?ctiid.316976 https://access.redhat.com/security/cve/cve-2025-7863
Share on: