Vulnerability · Published Feb 2, 2025 · Assigned by VulDB

CVE-2025-0970Zenvia Movidesk Login redirect

Medium 4.3

In plain English

A medium-severity open redirect in Movidesk from Zenvia. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 64.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Zenvia Movidesk up to 25.01.22. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /Account/Login. The manipulation of the argument ReturnUrl leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 25.01.22.245a473c54 is able to address this issue. It is recommended to upgrade the affected component.

Affected products (as reported)

Vendor	Product	Versions
Zenvia	Movidesk	25.01.025.01.125.01.225.01.325.01.425.01.525.01.625.01.7

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

VDB-294361 | Zenvia Movidesk Login redirect vdb-entry, technical-description
VDB-294361 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #485985 | zenvia movidesk < 25.01.15.86c796efe6 Open Redirect third-party-advisory