CVE-2025-24020: WeGIA Open Redirect vulnerability
WeGIA is a Web manager for charitable institutions. An Open Redirect vulnerability was identified in the control.php endpoint of versions up to and including 3.2.10 of the WeGIA application. The vulnerability allows the nextPage parameter to be manipulated, redirecting authenticated users to arbitrary external URLs without validation. The issue stems from the lack of validation for the nextPage parameter, which accepts external URLs as redirection destinations. This vulnerability can be exploited to perform phishing attacks or redirect users to malicious websites. Version 3.2.11 contains a fix for the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24020?
CVE-2025-24020 is classified as a medium severity vulnerability due to the potential for unauthorized redirection and exploitation.
How do I fix CVE-2025-24020?
To fix CVE-2025-24020, upgrade WeGIA to version 3.2.11 or later, which addresses the open redirect vulnerability.
What versions of WeGIA are affected by CVE-2025-24020?
Versions of WeGIA up to and including 3.2.10 are affected by CVE-2025-24020.
What does the open redirect vulnerability in CVE-2025-24020 allow?
The open redirect vulnerability in CVE-2025-24020 allows attackers to manipulate the 'nextPage' parameter, leading to potential phishing attacks.
Who is impacted by CVE-2025-24020?
Any users or organizations utilizing WeGIA versions up to 3.2.10 are potentially impacted by CVE-2025-24020.