How severe is CVE-2025-24868?

This vulnerability has a severity rating of HIGH with a CVSS score of 7.1 out of 10.

What type of vulnerability is CVE-2025-24868?

This is classified as CWE-601, which is a common weakness in software security.

CVE-2025-24868 - HIGH Severity | CVSS 7.1

Vulnerability Description

The User Account and Authentication service (UAA) for SAP HANA extended application services, advanced model (SAP HANA XS advanced model) allows an unauthenticated attacker to craft a malicious link, that, when clicked by a victim, redirects the browser to a malicious site due to insufficient redirect URL validation. On successful exploitation attacker can cause limited impact on confidentiality, integrity, and availability of the system.

Related Vulnerabilities

CVE-2023-3922

HIGH

CVSS:7.1(High)

An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was pos...

CWE-6012023

CVE-2023-6291

HIGH

CVSS:7.1(High)

A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, ma...

CWE-6012023

CVE-2024-22248

HIGH

CVSS:7.1(High)

VMware SD-WAN Orchestrator contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker controlled domain due to improper path handling leading to sensiti...

CWE-6012024

CVE-2024-2419

HIGH

CVSS:7.1(High)

A flaw was found in Keycloak's redirect_uri validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making ...

CWE-6012024

CVE-2024-2465

HIGH

CVSS:7.1(High)

Open redirection vulnerability in CDeX application allows to redirect users to arbitrary websites via a specially crafted URL.This issue affects CDeX application versions through 5.7.1.

CWE-6012024

CVE-2025-25198

HIGH

CVSS:7.1(High)

mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker to manipulate the `...

CWE-6012025