Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2025-58044: JumpServer may redirect users to malicious websites
CVE-2025-58044 · published 11 months ago
Summary
Versions of JumpServer before 3.10.19 and 4.10.5 can use the website's Referer information to send users to a different address without checking it first. This could allow an attacker to trick users into visiting a harmful site after they log in. Upgrade to JumpServer 3.10.19 or later, or 4.10.5 or later, to close the risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| fit2cloud | jumpserver |
< 3.10.19 >= 4.0.0, < 4.10.5 cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:* |
Original advisory text
JumpServer has an Open Redirect Vulnerability
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability. This vulnerability is fixed in v3.10.19 and v4.10.5.
References
- https://github.com/jumpserver/jumpserver/security/advisories/GHSA-h762-mj7p-jwjq Vendor Advisory
- https://github.com/jumpserver/jumpserver/commit/36ae076cb021f16d2053a63651bc16d1... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58044... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-58044 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.5
High
Type
CWE-601Open Redirect
Timeline
Published1 Dec 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta