CVE-2022-25295: Open Redirect
Vulnerability summary
CVE-2022-25295 is a medium (CVSS 5.4) URL Redirection to Untrusted Site vulnerability in getgophish gophish. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 52.7% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 5.4, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 11-09-2022PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The application uses url.Parse(r.FormValue("next")) to extract path and eventually redirect user to a relative URL, but if next parameter starts with multiple backslashes like \\\\\\example.com, browser will redirect user to http://example.com.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS trend
Probability
0.69%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.69% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (security.snyk.io)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Getgophish1 product
- gophish< 0.12.0
Github.com/gophish1 product
- gophish< 0.12.0
2 vendors · 2 products
References
7 links- security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOPHISHGOPHISH-2404177X Refsource MISCWEBExploitThird Party Advisory
- github.com/gophish/gophishPACKAGE