Medium severity · published Jan 24, 2025
CVE-2025-0705
JoeyBling bootplus QrCodeController.java qrCode redirect
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d and classified as problematic. Affected by this vulnerability is the function qrCode of the file src/main/java/io/github/controller/QrCodeController.java. The manipulation of the argument text leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
bootplus · JoeyBling
247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0705
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0705
Not Applicable
https://github.com/JoeyBling/bootplus/issues/27
Not Applicable
https://github.com/JoeyBling/bootplus/issues/27#issue-2786941847
Permissions Required
https://vuldb.com/?ctiid.293233
Third Party Advisory
https://vuldb.com/?id.293233
Third Party Advisory
https://vuldb.com/?submit.480844
More from bootplus
8.8
CVE-2025-0702
JoeyBling bootplus SysFileController.java unrestricted upload
8.8
CVE-2025-0701
JoeyBling bootplus list sql injection
8.8
CVE-2025-0700
JoeyBling bootplus list sql injection
8.8
CVE-2025-0699
JoeyBling bootplus list sql injection
8.8
CVE-2025-0698
JoeyBling bootplus list sql injection
