CVE-2025-0705

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-0705
A vulnerability has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d and classified as problematic. Affected by this vulnerability is the function qrCode of the file src/main/java/io/github/controller/QrCodeController.java. The manipulation of the argument text leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://github.com/JoeyBling/bootplus/issues/27 Not Applicable
https://github.com/JoeyBling/bootplus/issues/27#issue-2786941847 Not Applicable
https://vuldb.com/?ctiid.293233 Permissions Required VDB Entry
https://vuldb.com/?id.293233 Third Party Advisory VDB Entry
https://vuldb.com/?submit.480844 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:joeybling:bootplus:*:*:*:*:*:*:*:*
History

10 Oct 2025, 19:03

Type Values Removed Values Added
Summary
  • (es) Se ha encontrado una vulnerabilidad en JoeyBling bootplus hasta 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d y se ha clasificado como problemática. Esta vulnerabilidad afecta a la función qrCode del archivo src/main/java/io/github/controller/QrCodeController.java. La manipulación del texto del argumento provoca una redirección abierta. El ataque se puede ejecutar de forma remota. El exploit se ha hecho público y puede utilizarse. Este producto adopta el enfoque de lanzamientos continuos para proporcionar una distribución continua. Por lo tanto, no están disponibles los detalles de las versiones afectadas y actualizadas.
First Time Joeybling bootplus
Joeybling
CPE cpe:2.3:a:joeybling:bootplus:*:*:*:*:*:*:*:*
References () https://github.com/JoeyBling/bootplus/issues/27 - () https://github.com/JoeyBling/bootplus/issues/27 - Not Applicable
References () https://github.com/JoeyBling/bootplus/issues/27#issue-2786941847 - () https://github.com/JoeyBling/bootplus/issues/27#issue-2786941847 - Not Applicable
References () https://vuldb.com/?ctiid.293233 - () https://vuldb.com/?ctiid.293233 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.293233 - () https://vuldb.com/?id.293233 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.480844 - () https://vuldb.com/?submit.480844 - Third Party Advisory, VDB Entry

24 Jan 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-24 19:15

Updated : 2025-10-10 19:03

NVD link : CVE-2025-0705

Mitre link : CVE-2025-0705

CVE.ORG link : CVE-2025-0705

JSON object : View

Products Affected

joeybling

  • bootplus
CWE
CWE-601

URL Redirection to Untrusted Site ('Open Redirect')