Описание
A flaw was found in React Router, a routing library for React applications. A remote attacker could exploit this vulnerability by crafting a malicious link that uses backslashes within the or useNavigate components. This could lead to an Open Redirect, allowing the attacker to redirect users to arbitrary external websites, potentially for phishing or other malicious purposes.
Отчет
This Moderate impact open redirect vulnerability in React Router affects multiple Red Hat products. A remote attacker could exploit this by crafting a malicious link that uses backslashes in navigation components, leading to user redirection to arbitrary external websites. This could facilitate phishing attacks against users.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | cryostat-openshift-console-plugin-npm | Fix deferred | ||
| Cryostat 4 | grafana-infinity-datasource-npm | Fix deferred | ||
| Cryostat 4 | react-router | Fix deferred | ||
| Exploit Intelligence | exploit-intelligence-tech-preview/agent-client-rhel9 | Out of support scope | ||
| Gatekeeper 3 | gatekeeper/gatekeeper-rhel9 | Fix deferred | ||
| Migration Toolkit for Applications 8 | mta/mta-ui-rhel8 | Fix deferred | ||
| Migration Toolkit for Applications 8 | mta/mta-ui-rhel9 | Fix deferred | ||
| Migration Toolkit for Containers | rhmtc/openshift-migration-ui-rhel8 | Fix deferred | ||
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-console-plugin-rhel9 | Out of support scope | ||
| Multicluster Engine for Kubernetes | multicluster-engine/console-mce-rhel9 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.4 Medium
CVSS3
Связанные уязвимости
React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <Link> and useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed in version 7.18.0.
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
EPSS
5.4 Medium
CVSS3