CVE-2025-0431
Last modified
CVE-2025-0431 is a medium-severity vulnerability rated 5.8/10 on the CVSS scale. Enterprise Protection contains a vulnerability in URL rewriting that allows an unauthenticated remote attacker to send an email which bypasses URL protections impacting the integrity of recipient's email. This occurs due to improper filtering of backslashes within URLs and affects all versions of 8.21, 8.20 and 8.18 prior to 8.21.0 patch 5115, 8.20.6 patch 5114 and 8.18.6 patch 5113 respectively.. EPSS estimates a 0.39% chance of exploitation in the next 30 days.
Description
Enterprise Protection contains a vulnerability in URL rewriting that allows an unauthenticated remote attacker to send an email which bypasses URL protections impacting the integrity of recipient's email. This occurs due to improper filtering of backslashes within URLs and affects all versions of 8.21, 8.20 and 8.18 prior to 8.21.0 patch 5115, 8.20.6 patch 5114 and 8.18.6 patch 5113 respectively.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-0431?
How severe is CVE-2025-0431?
How do I fix CVE-2025-0431?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-0425Via the GUI of the "bestinformed Infoclient", a low-privileg…8.5
- CVE-2025-0426A security issue was discovered in Kubernetes where a large …6.2
- CVE-2025-0427Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel D…7.8
- CVE-2025-0428The "AI Power: Complete AI Pack" plugin for WordPress is vul…7.2
- CVE-2025-0429The "AI Power: Complete AI Pack" plugin for WordPress is vul…7.2
- CVE-2025-0430Belledonne Communications Linphone-Desktop is vulnerable t…8.7
- CVE-2025-0432EWON Flexy 202 transmits user credentials in clear text with…6.9
- CVE-2025-0433The Master Addons – Elementor Addons with White Label, Free …5.4
- CVE-2025-0434Out of bounds memory access in V8 in Google Chrome prior to …8.8
- CVE-2025-0435Inappropriate implementation in Navigation in Google Chrome …6.5
- CVE-2025-0436Integer overflow in Skia in Google Chrome prior to 132.0.683…8.8
- CVE-2025-0437Out of bounds read in Metrics in Google Chrome prior to 132.…8.8
Are you affected by CVE-2025-0431?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST